SIMATIC. ET 200pro CPU 1516pro-2 PN (6ES7516-2PN00-0AB0) Preface. Documentation guide. New properties / functions. Product overview 3

Transcription

1

2 Preface Documentation guide 1 SIMATIC ET 200pro CPU 1516pro-2 PN (6ES7516-2PN00-0AB0) Operating Instructions New properties / functions 2 Product overview 3 Mounting and connecting 4 Configuring 5 Basics of program execution 6 Protection 7 Commissioning 8 SIMATIC memory card 9 Maintenance 10 Test functions and fault resolution 11 Interrupts, diagnostics, error messages and system 12 events Technical specifications 13 A Dimension diagram B Accessories/spare parts 12/2017 A5E AB C Safety-relevant symbols

3 Legal information Warning notice system This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are graded according to the degree of danger. DANGER indicates that death or severe personal injury will result if proper precautions are not taken. WARNING indicates that death or severe personal injury may result if proper precautions are not taken. CAUTION indicates that minor personal injury can result if proper precautions are not taken. NOTICE indicates that property damage can result if proper precautions are not taken. If more than one degree of danger is present, the warning notice representing the highest degree of danger will be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to property damage. Qualified Personnel The product/system described in this documentation may be operated only by personnel qualified for the specific task in accordance with the relevant documentation, in particular its warning notices and safety instructions. Qualified personnel are those who, based on their training and experience, are capable of identifying risks and avoiding potential hazards when working with these products/systems. Proper use of Siemens products Note the following: Trademarks WARNING Siemens products may only be used for the applications described in the catalog and in the relevant technical documentation. If products and components from other manufacturers are used, these must be recommended or approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and maintenance are required to ensure that the products operate safely and without any problems. The permissible ambient conditions must be complied with. The information in the relevant documentation must be observed. All names identified by are registered trademarks of Siemens AG. The remaining trademarks in this publication may be trademarks whose use by third parties for their own purposes could violate the rights of the owner. Disclaimer of Liability We have reviewed the contents of this publication to ensure consistency with the hardware and software described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the information in this publication is reviewed regularly and any necessary corrections are included in subsequent editions. Siemens AG Division Digital Factory Postfach NÜRNBERG GERMANY A5E AB P 12/2017 Subject to change Copyright Siemens AG All rights reserved

4 Preface Purpose of the operating instructions This CPU 1516pro-2 PN operating instructions manual supplements the operating instructions of the ET 200pro decentralized I/O system. The information provided in this manual and the operating instructions of the ET 200pro enables you to commission the CPU 1516pro-2 PN. Basic knowledge required General knowledge in the field of automation engineering is required to understand this documentation. Validity of the documentation This documentation applies to the CPU 1516pro-2 PN of the ET 200pro distributed I/O system. Conventions STEP 7: In this documentation, "STEP 7" is used as a synonym for all versions of the configuration and programming software "STEP 7 (TIA Portal)". Please also observe notes marked as follows: Note A note contains important information on the product described in the documentation, on the handling of the product or on the section of the documentation to which particular attention should be paid. Operating Instructions, 12/2017, A5E AB 3

5 Preface Special information Note Important note for maintaining the operational safety of your plant Plants with safety-related features are subject to special operational safety requirements on the part of the operator. The supplier is also required to comply with certain measures for product monitoring. Siemens informs system operators in the form of personal notifications about product developments and properties which may be or become important issues in terms of operational safety. You need to subscribe to the corresponding notifications to ensure that you always remain up-to-date and are able to make any necessary changes to your plant regarding operational safety should the need arise. Log on to Industry Online Support. Follow the links below and click on " on update" on the right-hand side in each case: SIMATIC S7-300/S7-300F ( SIMATIC S7-400/S7-400H/S7-400F/FH ( SIMATIC WinAC RTX (F) ( SIMATIC S7-1500/SIMATIC S7-1500F ( SIMATIC S7-1200/SIMATIC S7-1200F ( Distributed I/O ( STEP 7 (TIA Portal) ( Note When using F-CPUs in safety mode, note the description of the fail-safe system SIMATIC Safety Programming and Operating Manual SIMATIC Safety - Configuring and Programming ( Recycling and disposal The products are low in pollutants and can be recycled. For environmentally compliant recycling and disposal of your electronic waste, please contact a company certified for the disposal of electronic waste. 4 Operating Instructions, 12/2017, A5E AB

6 Preface Security information Siemens provides products and solutions with industrial security functions that support the secure operation of plants, systems, machines and networks. In order to protect plants, systems, machines and networks against cyber threats, it is necessary to implement and continuously maintain a holistic, state-of-the-art industrial security concept. Siemens' products and solutions constitute one element of such a concept. Customers are responsible for preventing unauthorized access to their plants, systems, machines and networks. Such systems, machines and components should only be connected to an enterprise network or the internet if and to the extent such a connection is necessary and only when appropriate security measures (e.g. firewalls and/or network segmentation) are in place. For additional information on industrial security measures that may be implemented, please visit ( Siemens' products and solutions undergo continuous development to make them more secure. Siemens strongly recommends that product updates are applied as soon as they are available and that the latest product versions are used. Use of product versions that are no longer supported, and failure to apply the latest updates may increase customers' exposure to cyber threats. To stay informed about product updates, subscribe to the Siemens Industrial Security RSS Feed under ( Siemens Industry Online Support You can find current information on the following topics quickly and easily here: Product support All the information and extensive know-how on your product, technical specifications, FAQs, certificates, downloads, and manuals. Application examples Tools and examples to solve your automation tasks as well as function blocks, performance information and videos. Services Information about Industry Services, Field Services, Technical Support, spare parts and training offers. Forums For answers and solutions concerning automation technology. mysupport Your personal working area in Industry Online Support for messages, support queries, and configurable documents. This information is provided by the Siemens Industry Online Support in the Internet ( Operating Instructions, 12/2017, A5E AB 5

7 Preface Industry Mall The Industry Mall is the catalog and order system of Siemens AG for automation and drive solutions on the basis of Totally Integrated Automation (TIA) and Totally Integrated Power (TIP). Catalogs for all the products in automation and drives are available on the Internet ( 6 Operating Instructions, 12/2017, A5E AB

8 Table of contents Preface Documentation guide New properties / functions Product overview Application How it works Properties Operator control and display elements Front view of the module Mode switch Mounting and connecting Contents Mounting the CPU and connection module Connecting the connection module CM CPU 2PN M12 7/8" Connecting an RJ45 socket Wiring and circuit diagram Configuring Introduction to configuring Configuring the CPU Reading out the configuration Address assignment Addressing - overview Addressing digital electronic modules Addressing analog electronic modules Process images and process image partitions Process image - overview Assign process image partitions to an OB Update process image partitions in the user program Basics of program execution Events and OBs CPU overload behavior Asynchronous instructions Protection Overview of the protection functions Operating Instructions, 12/2017, A5E AB 7

9 Table of contents 7.2 Configuring access protection for the CPU Using the user program to set additional access protection Know-how protection Copy protection Commissioning Overview Procedure for commissioning the ET 200pro distributed I/O system with CPU Introduction PROFINET IO CPU as IO controller CPU as I-device Inserting/replacing SIMATIC memory card Operating modes of the CPU Operating modes of the CPU STARTUP mode STOP mode RUN mode Operating mode transitions CPU memory reset Introduction Automatic memory reset Manual memory reset Backing up and restoring the CPU configuration Identification and maintenance data Reading out and entering I&M data Data record structure for I&M data Shared commissioning of projects SIMATIC memory card SIMATIC memory card - overview Setting the card type Data transfer with SIMATIC memory cards Maintenance Firmware update Resetting the CPU to factory settings Test functions and fault resolution Test functions Reading out/saving service data Interrupts, diagnostics, error messages and system events Status and error display of the CPU Technical specifications Operating Instructions, 12/2017, A5E AB

10 Table of contents A Dimension diagram B Accessories/spare parts C Safety-relevant symbols C.1 Safety-related symbols for devices without Ex protection C.2 Safety-related symbols for devices with Ex protection Glossary Index Operating Instructions, 12/2017, A5E AB 9

11 Documentation guide 1 The documentation for the distributed I/O system ET 200pro and for the S based CPU 1516pro-2 PN is arranged into various areas. This arrangement enables you to access the specific content you require. Basic and device information The operating instructions describe in detail the configuration, installation, wiring and commissioning of the ET 200pro distributed I/O system. In addition, the operating instructions also contain device information such as properties, wiring diagrams, characteristics, and technical specifications. The STEP 7 online help supports you in the configuration and programming. General information The function manuals contain detailed descriptions on general topics such as diagnostics, communication, Motion Control, Web server, OPC UA. You can download the documentation free of charge from the Internet ( Changes and supplements to the manuals are documented in a Product Information. "mysupport" With "mysupport", your personal workspace, you make the best out of your Industry Online Support. In "mysupport", you can save filters, favorites and tags, request CAx data and compile your personal library in the Documentation area. In addition, your data is already filled out in support requests and you can get an overview of your current requests at any time. You must register once to use the full functionality of "mysupport". You can find "mysupport" on the Internet ( 10 Operating Instructions, 12/2017, A5E AB

12 Documentation guide "mysupport" - Documentation In the Documentation area in "mysupport" you can combine entire manuals or only parts of these to your own manual. You can export the manual as PDF file or in a format that can be edited later. You can find "mysupport" - Documentation on the Internet ( "mysupport" - CAx data In the CAx data area in "mysupport", you can access the current product data for your CAx or CAe system. You configure your own download package with a few clicks. In doing so you can select: Product images, 2D dimension drawings, 3D models, internal circuit diagrams, EPLAN macro files Manuals, characteristics, operating manuals, certificates Product master data You can find "mysupport" - CAx data on the Internet ( Application examples The application examples support you with various tools and examples for solving your automation tasks. Solutions are shown in interplay with multiple components in the system - separated from the focus on individual products. You will find the application examples on the Internet ( TIA Selection Tool With the TIA Selection Tool, you can select, configure and order devices for Totally Integrated Automation (TIA). This tool is the successor of the SIMATIC Selection Tool and combines the known configurators for automation technology into one tool. With the TIA Selection Tool, you can generate a complete order list from your product selection or product configuration. You can find the TIA Selection Tool on the Internet ( Operating Instructions, 12/2017, A5E AB 11

13 Documentation guide SIMATIC Automation Tool You can use the SIMATIC Automation Tool to perform commissioning and maintenance activities simultaneously on various SIMATIC S7 stations as a bulk operation independent of the TIA Portal. General function overview: Network browsing and creation of a table showing the accessible devices in the network. Flashing of device LEDs or HMI display to locate a device Downloading of addresses (IP, subnet, gateway) to a device Downloading the PROFINET name (station name) to a device Placing a CPU in RUN or STOP mode Setting the time in a CPU to the current time of your PG/PC Downloading a new program to a CPU or an HMI device Downloading from CPU, downloading to CPU or deleting recipe data from a CPU Downloading from CPU or deleting data log data from a CPU Backup/restore of data from/to a backup file for CPUs and HMI devices Downloading service data from a CPU Reading the diagnostics buffer of a CPU Performing a CPU memory reset Resetting devices to factory settings Downloading a firmware update to a device You can find the SIMATIC Automation Tool on the Internet ( PRONETA With SIEMENS PRONETA (PROFINET network analysis), you analyze the PROFINET network during commissioning. PRONETA features two core functions: The topology overview independently scans PROFINET network and all connected components. The IO check is a fast test of the wiring and the module configuration of a system. You can find SIEMENS PRONETA on the Internet ( 12 Operating Instructions, 12/2017, A5E AB

14 New properties / functions 2 What's new in the operating instructions CPU 1516pro-2 PN, Version 12/2017 compared to Version 09/2016 What's new? What are the customer benefits? Where can I find information? New contents Importing the configuration Password provider When there is a connection to a physically present CPU, you can use the "Hardware detection" function to read the configuration of the CPU and apply the configuration in your project. Thanks to the automatic import of the physical configuration, you do not need to manually configure the CPU. This saves you time and avoids input errors. As an alternative to manual password entry, you can link a password provider to STEP 7. A password provider provides the following advantages: Convenient handling of passwords. STEP 7 automatically reads in the password for the blocks. This saves you time Optimal block protection because the operators do not know the actual password Section Importing the configuration (Page 33) Section Know-how protection (Page 66) Instruction GetSMCinfo Testing with breakpoints Using the GetSMCinfo instruction, you can respond to information provided by the memory card in the user program and, if necessary, replace the memory card as a precautionary measure. This makes sense in particular if you write to the card often in your application, for example if you use data logs. When testing with breakpoints, you run a program from breakpoint to breakpoint. Testing with breakpoints offers the following advantages: Testing SCL and STL program code using breakpoints Narrowing down logic errors step-by-step Simple and rapid analysis of complex programs before actual commissioning Acquisition of actual values within individual loop passes Utilization of breakpoints for program validation also possible in SCL networks with LAD / FBD possible Section SIMATIC memory card - overview (Page 98) Section Test functions (Page 113) Operating Instructions, 12/2017, A5E AB 13

15 New properties / functions What's new? What are the customer benefits? Where can I find information? Changed contents UDP The maximum data length of the connectionless network protocol UDP (UDP-Unicast and UDP-Multicast) amounts to 2 KB. You transfer a larger amount of data per UDP packet via Industrial Ethernet. Section Technical specifications (Page 126) Fetching the identification and maintenance data with the Get_IM_Data instruction Using the Get_IM_Data instruction, you can read the identification and maintenance data of the modules with little programming work. With the Get_IM_Data instruction you can access identification and maintenance data (I&M) of a module in the user program. I&M data is stored information in a module. This allows you to Check plant configurations Respond to hardware modifications. Respond to hardware faults in the user program Finding and elimination of hardware errors is made easier. Section Fetching and entering I&M data (Page 93) See also Product overview (Page 15) 14 Operating Instructions, 12/2017, A5E AB

16 Product overview Application The CPU 1516pro-2 PN is a component of the ET 200pro distributed I/O system in degree of protection IP65, IP66 and IP67. The CPU provides you with maximum performance combined with excellent usability. It is suitable for a variety of demanding applications and communication tasks in automation engineering. It features: Integrated PROFINET interfaces Integrated Web server Integrated functionalities: Trace Motion control Closed-loop control functions OPC UA functionalities: OPC UA server Integrated technological functions Security Integrated The CPU supports motion control functions. STEP 7 provides PLCopen standardized blocks for configuring and connecting a drive to the CPU. Motion control functionalities support speed-controlled, positioning and synchronous axes as well as external encoders. For effective commissioning and fast optimization of drives and closed-loop controls, the CPU supports extensive trace functions. In addition to drive integration, the CPU has extensive closed-loop control functions, such as easy-to-configure blocks for automatic optimization of the controller parameters for optimized control quality. Due to the supported technology functions, the CPU is suitable for controlling pumps, fans, mixers, conveyor belts, lifting platforms, gate control systems, building management systems, synchronized axes, cross cutters, etc. The CPU provides, in conjunction with STEP 7, password-based know-how protection against unauthorized reading out or modification of the program blocks. The copy protection provides reliable protection against unauthorized reproduction of program blocks. With copy protection you associate individual blocks with the serial number of the CPU or SIMATIC memory card. In addition, you can assign various access rights to different user groups using four different authorization levels. Through an improved manipulation protection, the CPU detects modified or unauthorized transmissions of engineering data. Operating Instructions, 12/2017, A5E AB 15

17 Product overview 3.1 Application Safety Integrated The fail-safe CPU is intended for users who want to implement demanding standard and failsafe applications both centrally and decentrally. The fail-safe CPU enables the processing of standard and safety programs on a single CPU. This allows you to evaluate fail-safe data in the standard user program. As a result of this integration, the system advantages and the extensive functionality of SIMATIC are also available for fail-safe applications. The fail-safe CPU is certified for use in safety mode up to: Safety class (Safety Integrity Level) SIL 3 according to IEC 61508:2010 Performance Level (PL) e and Category 4 according to ISO :2006 or according to EN ISO :2008 Additional password protection for F-configuration and F-program is set up for IT security. System diagnostics Integrated system diagnostics is enabled by default for the CPUs. Instead having to invest work in programming the diagnostic types, you can configure these on the user interface of STEP 7. The CPU shows system diagnostic information with a uniform design and in plain text in STEP 7, on the HMI and on the Web server, even alarms of the drives. This information is available in RUN mode, but also in STOP mode of the CPU. The CPU automatically updates diagnostic information when you have configured new hardware components. OPC UA OPC UA is an open and vendor-neutral communication protocol. The CPU can be used as an OPC UA server. 16 Operating Instructions, 12/2017, A5E AB

18 Product overview 3.2 How it works 3.2 How it works The CPU contains the operating system and executes the user program. The user program is located on the SIMATIC memory card and runs in the work memory of the CPU. The PROFINET interfaces on the CPU allow simultaneous communication with: PROFINET devices PROFINET controllers HMI devices Programming devices Other control systems and further systems The CPU 1516pro-2 PN supports operation as an IO controller and I-device. IO controller As an IO controller, the CPU 1516pro-2 PN sends and receives data from the connected IO devices within a PROFINET IO system. You can operate the following IO devices on the PROFINET interfaces of the CPU: 1st PROFINET interface (X1): maximum of 256 IO devices, of which a maximum of 64 in IRT (Isochronous real-time). 2nd PROFINET interface (X2): maximum of 32 PROFINET devices I-device The "I-device" (intelligent IO device) functionality allows you to exchange data with an IO controller. The CPU 1516pro-2 PN thus fulfills the role of an intelligent distributed preprocessing unit of sub-processes. The I-device is connected to a "higher-level" IO controller as an IO device. Advantages: Interference-resistant configuration due to short signal and encoder wiring Reduced wiring effort for transmission of data via PROFINET Operating Instructions, 12/2017, A5E AB 17

19 Product overview 3.3 Properties 3.3 Properties Article number 6ES7516-2PN00-0AB0 (CPU 1516pro-2 PN) 6ES7194-4AP00-0AA0 (Connection module CM CPU 2PN M12 7/8") View of the module The figure below shows the CPU 1516pro-2 PN. Figure 3-1 CPU 1516pro-2 PN 18 Operating Instructions, 12/2017, A5E AB

20 Product overview 3.3 Properties Properties CPU 1516pro-2 PN has the following properties: Supply voltage Property Description Additional information You connect the 24 VDC supply voltage via the connection module CM CPU 2PN M12, 7/8". Section Mounting and connecting (Page 23) Operating instructions of the ET 200pro Distributed I/O System ( com/cs/ww/en/view/ ) PROFINET IO PROFINET interface X1 PROFINET interface X2 Operation of the CPU as IO controller I-device The first PROFINET interface (X1) has three ports (P1 R, P2 R and P3). In addition to PROFINET basic functionality, it also supports PROFINET IO RT (realtime) and IRT (isochronous real-time). P1R and P2R are M12 circular sockets (with female contact insert). They can also be used as ring ports for the configuration of redundant ring structures in Ethernet (media redundancy). P3 is an RJ45-socket and is suitable, for example, for connecting a PC, programming or HMI device. The 2nd PROFINET interface (X2) has one port (P1). P1 is an M12 circular socket (with female contact insert). In addition to basic PROFINET functionality, P1 also supports PROFINET IO RT (Real-time). IRT (Isochronous real-time) is not supported by this interface. IO controller: As an IO controller, the CPU addresses the connected IO devices I-device As an I-device, the CPU is assigned to a high-level IO controller and is used as an intelligent preprocessing unit of sub-processes PROFINET Function Manual ( m/cs/ww/en/view/ ) See also FHB_Cycle_Reaction_Times ( Trace ( Motion control ( Internet ( Sizer ( TIA Selection Tool ( Operating Instructions, 12/2017, A5E AB 19

21 Product overview 3.4 Operator control and display elements 3.4 Operator control and display elements Front view of the module Operator control and connection elements The figure below shows the operator controls and connection elements of the CPU 1516pro-2 PN. 1 M12 circular socket with female contact insert for connection to PROFINET (Port 1 of PROFINET interface X2) 2 Status and error displays 3 Mode switch 4 RJ45 socket; e.g. for connecting a programming device for service purposes (Port 3 of PROFINET interface X1). This port cannot be used as a ring port. 5 7/8" circular socket with female contact insert (X4) for loop-through of electronics/encoder supply 1L+ and load voltage supply 2L+ 6 7/8" circular socket with male contact insert (X3) for infeed of electronics/encoder supply 1L+ and load voltage supply 2L+ 7 M12 circular socket with female contact insert for connection to PROFINET (Port 2 of PROFINET interface X1) R: Ring port for configuration of a ring topology with media redundancy* 8 M12 circular socket with female contact insert for connection to PROFINET (Port 1 of PROFINET interface X1) R: Ring port for configuration of a ring topology with media redundancy* Figure 3-2 View of CPU 1516pro-2 PN 20 Operating Instructions, 12/2017, A5E AB

22 Product overview 3.4 Operator control and display elements Slot for the SIMATIC memory card Figure 3-3 Slot for the SIMATIC memory card CPU 1516pro-2 PN uses a SIMATIC memory card as the memory module. You can use the SIMATIC memory card as load memory or as a portable storage medium. The slot for the SIMATIC memory card is accessible on the front of the CPU after removing the connection module. You can find detailed information on removing and inserting the SIMATIC memory card in section Inserting/replacing SIMATIC memory card (Page 79). Operating Instructions, 12/2017, A5E AB 21

23 Product overview 3.5 Mode switch 3.5 Mode switch Use the mode switch to set the CPU operating mode. The following table shows the position of the switch and the corresponding meaning. Table 3-1 Mode switch settings Position Meaning Explanation RUN RUN mode The CPU is executing the user program. STOP STOP mode The user program is not being executed. MRES Memory reset Position for CPU memory reset. 22 Operating Instructions, 12/2017, A5E AB

24 Mounting and connecting Contents Where can I find what information? You can find detailed information on mounting and connecting an ET 200pro in the corresponding sections of the ET 200pro operating instructions ( In the sections below, you will learn the differences and special requirements for setup of an ET 200pro with the CPU 1516pro-2 PN. Operating Instructions, 12/2017, A5E AB 23

25 Mounting and connecting 4.2 Mounting the CPU and connection module 4.2 Mounting the CPU and connection module Introduction The CPU 1516pro-2 PN connects the ET 200pro to PROFINET IO and exchanges the preprocessed data with the higher-level controller. Requirements The termination module is removed from the CPU. The module rack is mounted (see Operating instructions ET 200pro ( Tools required Cross-tip screwdriver, size 2 Procedure 1. Insert the CPU onto the rack until it engages and then move it as needed to the correct position. 2. Screw the CPU to the module rack. 2 recessed head screws on the front: top and bottom, tightening torque 1.5 N/m 3. Insert a blank SIMATIC memory card or a memory card with the correct configuration in the card slot. You can find information on this in the section Inserting/replacing SIMATIC memory card (Page 79). 4. Insert the connection module CM CPU 2PN M12, 7/8" onto the CPU. 5. Screw the terminal module onto the rack. 4 recessed head screws on the front, 1.5 Nm torque. 6. Mount the electronic modules and any power modules or motor starters. You can find information in the ET 200pro operating instructions ( 7. Mount the termination module (see ET 200pro operating instructions ( for information on this). 24 Operating Instructions, 12/2017, A5E AB

26 Mounting and connecting 4.3 Connecting the connection module CM CPU 2PN M12 7/8" 4.3 Connecting the connection module CM CPU 2PN M12 7/8" Introduction Connect the supply voltages and PROFINET to the connection module CM CPU 2PN M12, 7/8". The 1st PROFINET interface (X1) is equipped with an internal PROFINET switch. This enables the direct loop-through of PROFINET or the direct connection of another IO device (e.g. ET 200pro with IM PN). Use X1 Port 1 and X1 Port 2 for configuring ring topologies. The 2nd PROFINET interface (X2) has only one port. Figure 4-1 View of the connection module CM CPU 2PN M12, 7/8" X2 P1 X1 P1 R X1 P2 R X3 DC 24V X4 DC 24V M12 circular socket (with female contact insert) for connection of PROFINET M12 circular socket connector (with socket insert) for connection of PROFINET R: Ring port for configuring a ring topology with media redundancy M12 circular socket connector (with socket insert) for connection of PROFINET R: Ring port for configuring a ring topology with media redundancy 7/8" circular socket (with male contact insert) for infeed of electronics/encoder supply 1L+ and load voltage supply 2L+ 7/8" circular socket (with female contact insert) for loop-through of electronics/encoder supply 1L+ and load voltage supply 2L+ Operating Instructions, 12/2017, A5E AB 25

27 Mounting and connecting 4.3 Connecting the connection module CM CPU 2PN M12 7/8" CAUTION PROFINET You may operate modules with PROFINET interfaces only in LAN networks (Local Area Network) in which all the connected nodes are equipped with a SELV/PELV power supply (or equivalent). A data transfer terminal (modem, for example) is required to access the WAN (Wide Area Network) in order to ensure compliance with this safety standard. Requirements The CPU (including bus module) and the connection module CM CPU 2PN M12, 7/8" are mounted on the module rack. Tools required Screwdriver Insulation stripping tool for wiring if you are assembling the cables yourself. Accessories required Pre-fabricated cable with M12 and 7/8" connectors The patch cables are available in different lengths. To produce your own cable: M12: PROFINET cable (4-wire, shielded) and M12 PROFINET connection plug (d-coded) 7/8": 5-wire patch cable with 7/8" connectors Pin assignment of the M12 connector M12 circular socket X1-P1 R and X1-P2 R: If autonegotiation is activated, then the M12 circular socket has the switch assignment (MDI-X). If autonegotiation is activated, then autocrossing is active and the M12 circular socket has either a device assignment (MDI) or switch assignment (MDI-X). 26 Operating Instructions, 12/2017, A5E AB

28 Mounting and connecting 4.3 Connecting the connection module CM CPU 2PN M12 7/8" M12 circular socket X2-P1: Autocrossing is always active. As a result, the M12 circular socket has either a device assignment (MDI) or switch assignment (MDI-X). View of M12 connector, d- coded (PROFINET) Terminal MDI (device assignment) MDI-X (switch assignment) Assignment Assignment X1 P1 R, X1 P2 R, X2-P1 for connection of PROFINET 1 TD_P (Transmit Data +) RD_P (Receive Data +) 2 RD_P (Receive Data +) TD_P (Transmit Data +) 3 TD_N (Transmit Data ) RD_N (Receive Data ) 4 RD_N (Receive Data ) TD_N (Transmit Data ) Thread Functional ground Pin assignment of the 7/8" connector View of 7/8" connector (supply voltage 1L+ und 2L+) Terminal Assignment X3 DC 24 V for infeed X4 DC 24 V for loop-through 1 Load voltage ground 2M 2 Ground for electronics/encoder supply 1M 3 Functional ground 4 Electronic / encoder supply 1L+ 5 Load voltage supply 2L+ Operating Instructions, 12/2017, A5E AB 27

29 Mounting and connecting 4.3 Connecting the connection module CM CPU 2PN M12 7/8" Connecting M12 and 7/8" connectors 1. Press the M12 and 7/8" connection plugs into the corresponding circular sockets on the connection module CM CPU 2PN M12, 7/8". Ensure that the connector and socket are properly engaged. 2. Tighten the connectors with the knurled screw (torque = 1.5 N/m). NOTICE It is not permissible to remove the 7/8" connection plug during operation! It is not allowed to remove the 7/8" connector while ET 200pro is in operation! Always switch off the 1L+ electronics/encoder supply and the 2L+ load voltage supply before you pull or plug the 7/8" cable connector. Note Removal of the 7/8" connector interrupts the supply to downstream modules. Closing unused sockets Always close all unused sockets with M12 and 7/8" cover caps (see section Accessories) in order to achieve degree of protection IP65, IP66 or IP67. You can find the order numbers of the cover caps in appendix Accessories/spare parts (Page 140). 28 Operating Instructions, 12/2017, A5E AB

30 Mounting and connecting 4.4 Connecting an RJ45 socket 4.4 Connecting an RJ45 socket Introduction You can connect, for example, a programming device to the RJ45 socket of the CPU. The PROFINET interface is equipped with an internal switch that allows PROFINET nodes to be connected directly. 1 X1 P3 RJ45 socket for connecting to PROFINET Figure 4-2 RJ45 socket Requirements The CPU (including bus module) and the connection module CM CPU 2PN M12, 7/8" are mounted on the module rack. Tools required 32 mm open-ended wrench Accessories required Pre-assembled PROFINET cable with RJ45 connection plug. The cable is available in different lengths. Operating Instructions, 12/2017, A5E AB 29

31 Mounting and connecting 4.4 Connecting an RJ45 socket Pin assignment of the RJ45 connector The assignment corresponds to the Ethernet standard for an RJ45 connection plug. RJ45 socket X1 P3: If autonegotiation is activated, then the RJ45 socket has the switch assignment (MDI-X). If autonegotiation is activated, then autocrossing is active and the RJ45 socket has either a device assignment (MDI) or switch assignment (MDI-X). Figure 4-3 View of RJ45 socket Connect the RJ45 connector 1. Unscrew the screw cap from the CPU. 2. Push the RJ45 connection plug into the socket on the CPU. Note Ensuring degree of protection IP65, IP66 and IP67 after removing the RJ45 connector Screw the screw cap back onto the CPU in order to achieve degree of protection IP65, IP66 and IP67. Hand-tighten the cap (minimum tightening torque 1.0 Nm). 30 Operating Instructions, 12/2017, A5E AB

32 Mounting and connecting 4.5 Wiring and circuit diagram 4.5 Wiring and circuit diagram The figure below shows the wiring and circuit diagram of the CPU 1516pro-2 PN. 1 Infeed of electronics/encoder supply 1L+ and load voltage supply 2L+ (X3) 2 Loop-through of electronics/encoder supply 1L+ and load voltage supply 2L+ (X4) 3 PROFINET interface X2 Port 1 (X2 P1) ERROR LED diagnostic status (red) 4 PROFINET interface X1 Port 1 (X1 P1 R) MAINT LED diagnostic status (yellow) 5 PROFINET interface X1 Port 2 (X1 P2 R) 24 V DC LED load voltage supply (green) 6 PROFINET interface X1 Port 3 (X1 P3) X1 P1 PROFINET LEDs (green) 7 SIMATIC memory card X1 P2 8 Mode switch X1 P3 9 Ethernet controller X2 P1 RUN Figure 4-4 LED operating mode (green) Wiring and circuit diagram Operating Instructions, 12/2017, A5E AB 31

33 Configuring Introduction to configuring Introduction By configuring the individual hardware components, assigning their parameters, and connecting them, you communicate to the ET 200pro distributed I/O system its preset configuration and mode of functioning. You perform the work needed for this in the device and network views in STEP 7. "Configuring" is understood to mean the arranging, setup and networking of devices and modules within the device view or network view of STEP 7. STEP 7 represents modules and module racks graphically. Just like "real" module racks, the device view allows the insertion of a defined number of modules. When modules are inserted, STEP 7 automatically assigns the addresses and a unique hardware identifier (HW identifier). You can change the addresses later. The HW identifiers cannot be changed. At startup, the system components compare the configured preset configuration with the actual configuration of the system. By means of parameter assignment, you can specify the response of the CPU to errors in the hardware configuration. "Assigning parameters" is understood to mean setting the properties of the components used (CPU, modules). STEP 7 compiles the hardware configuration (result of "configuring" and "assigning parameters") and downloads it to the CPU. The CPU then connects to the configured components and transfers their configuration and parameters. Modules can be replaced very easily because STEP 7 transfers the configuration and parameters when a new module it is inserted. Requirements for configuration of the CPU Table 5-1 Requirements for configuring Configuration software STEP 7 (TIA Portal) as of V14 Information on configuring STEP 7 online help Reference You can find an overview of the most important documents and links for the TIA Portal in an FAQ on the Internet ( 32 Operating Instructions, 12/2017, A5E AB

34 Configuring 5.2 Configuring the CPU 5.2 Configuring the CPU Reading out the configuration Introduction When there is a connection to a physically present CPU, you can load the configuration of this CPU, including present modules, from the device into your project using the "Hardware detection" function. You do not need to manually configure the CPU and the present modules, since the physical configuration is read out automatically. If you have already configured a CPU and the present modules and you want to load the current configuration and parameters in a new project, it is advisable to use the "Upload device as new station" function. For more information about this function, refer to section Backing up and restoring the CPU configuration (Page 90). Requirements Note Take into account that the Hardware detection function only recognizes modules with identification data I&M0 at an ET 200pro distributed I/O system. All modules that do not have access to I&M0 identification data are displayed in the hardware configuration as an empty slot. You have to manually configure and assign parameters to these modules Table 5-2 ET 200pro modules without I&M0 identification data (manual configuration and parameter assignment required) Module Article number PM-E DC 24V power module 6ES7148-4CA00-0AA0 PM-O DC 2x24V power module 6ES7148-4CA60-0AA0 8 DI DC 24V electronic module 6ES7141-4BF00-0AA0 16 DI DC 24V electronic module 6ES7141-4BH00-0AA0 4 DO DC 24V/2.0A electronic module 6ES7142-4BD00-0AA0 8 DO DC 24V/0.5A electronic module 6ES7142-4BF00-0AA0 4 DI / 4 DO DC 24V/0.5A electronic module 6ES7143-4BF50-0AA0 4 DIO / 4 DO DC 24V/0.5A electronic module 6ES7143-4BF00-0AA0 16 DO DC 24V CPV10 pneumatic interface module 6ES7148-4EA00-0AA0 16 DO DC 24V CPV14 pneumatic interface module 6ES7148-4EB00-0AA0 Motor starter repair switch module RSM 15A 3RK1304-0HS00-6AA0 Motor starter local repair switch module F-RSM 16A 3RK1304-0HS00-7AA0 Motor starter disconnecting module ASM 400V 25A 3RK1304-0HS00-8AA0 Operating Instructions, 12/2017, A5E AB 33

35 Configuring 5.2 Configuring the CPU Procedure for reading out an existing configuration 1. Create a new project and configure an "Unspecified CPU". Figure 5-1 Unspecified CPU in the device view Note Click the "detect" link to open the "Hardware detection for PLC_x" dialog. An alternative procedure is described in Step 2 and Step Operating Instructions, 12/2017, A5E AB

36 Configuring 5.2 Configuring the CPU 2. In the device view (or network view), select the "Hardware detection" command in the "Online" menu. Figure 5-2 Hardware detection in the Online menu STEP 7 opens the "Hardware detection for PLC_x" dialog box. Operating Instructions, 12/2017, A5E AB 35

37 Configuring 5.2 Configuring the CPU 3. In the "Hardware detection for PLC_x" dialog box, click "Refresh". Then, select the CPU and click "Detect". Figure 5-3 Hardware detection dialog box 36 Operating Instructions, 12/2017, A5E AB

38 Configuring 5.2 Configuring the CPU Result of the hardware detection STEP 7 has read the hardware configuration and the modules and transferred them to your project. STEP 7 assigns valid default parameters for all modules. You can change the parameter assignment subsequently. Figure 5-4 Result of the hardware detection in the device view Note If you want to go online after the hardware detection, you have to first download the detected configuration to the CPU; otherwise, an error may occur due to inconsistent configurations. Properties of central modules Reference The properties of the CPU have special significance for system behavior. For a CPU, you can, for example, make the following settings in STEP 7: Startup characteristics Parameter assignment of the interface(s), e.g. IP address, subnet mask Web server, e.g., activation, user administration, and languages OPC UA server Global Security Certificate Manager Cycle times, e.g., maximum cycle time System and clock memory Protection level for access protection with assigned password parameter Time and day settings (daylight saving/standard) The properties that can be set and the corresponding value ranges are specified by STEP 7. Fields that cannot be edited are grayed out. You can find additional information on configuring the CPU / I/O modules and the individual settings in the STEP 7 online help. Operating Instructions, 12/2017, A5E AB 37

39 Configuring 5.2 Configuring the CPU Address assignment Addressing - overview Introduction In order to address the automation components or modules, they have to have unique addresses. The following section explains the various address areas. I/O address I/O addresses (input/output addresses) are required in the user program to read inputs and set outputs. STEP 7 automatically assigns input and output addresses when modules are configured. Each module uses a continuous range of input and/or output addresses corresponding to its volume of input and output data. Figure 5-5 Example with input/output addresses from STEP 7 STEP 7 assigns the address areas of the modules by default to the process image partition 0 ("Automatic updating"). This process image partition is updated in the main cycle of the CPU. Device address (e.g., Ethernet address) Device addresses are addresses of modules with interfaces to a subnet (e.g. IP address). They are required to address the various devices on a subnet, for example, to download a user program. 38 Operating Instructions, 12/2017, A5E AB

40 Configuring 5.2 Configuring the CPU Hardware identifier STEP 7 automatically assigns a hardware identifier (HW identifier) for identification and addressing of modules and submodules. The HW identifier is used, for example, for diagnostics alarms or for instructions, to identify the faulty module or the addressed module. Figure 5-6 Example of a hardware identifier from STEP 7 The "System constants" tab contains all hardware identifiers and their symbolic names (of HW identifier) for the selected module. The HW identifiers and names of all modules of a device are also available in the default tag table on the "System constants" tab. Figure 5-7 Example of a default tag table from STEP 7 Operating Instructions, 12/2017, A5E AB 39

41 Configuring 5.2 Configuring the CPU Addressing digital electronic modules Introduction The following section describes the addressing of the digital electronic modules. You need the addresses of the channels of the digital electronic module in the user program. Addresses of the digital electronic modules The address of an input or output of a digital electronic module is composed of the byte address and the bit address. The channels of the digital electronic modules are assigned bit addresses. Example: I 1.2 The example consists of: I Input - 1 Byte address The byte address depends on the module start address 2 Bit address You read the bit address from the module When you insert a digital electronic module into a free slot, STEP 7 assigns a default address. You can change the proposed default address in STEP Operating Instructions, 12/2017, A5E AB

42 Configuring 5.2 Configuring the CPU Example of the assignment of addresses to channels (digital electronic module) The following figure shows how the addresses of the individual channels arise using the digital electronic module 16 DI DC 24 V as an example. 1 Channels 0 to 7; byte address: Module start address 2 Channels 8 to 15; byte address: Module start address +1 Figure 5-8 Example of the assignment of addresses to channels (digital electronic module) Note You can assign symbolic names to the addresses at the following locations in STEP 7: PLC tag table Properties of the module in the "IO Tags" tab. Operating Instructions, 12/2017, A5E AB 41

43 Configuring 5.2 Configuring the CPU Address space using the digital electronic module 16 DI DC 24 V as an example Figure 5-9 Address space 16 DI DC 24 V Reference You can find additional information on addressing and address allocation in the operating instructions of the ET 200pro distributed I/O system ( and in the STEP 7 online help Addressing analog electronic modules Introduction The following section describes the addressing of analog electronic modules. You need the addresses of the channels of the analog electronic module in the user program. Analog module addresses The address of an analog channel is always a word address. The channel address depends on the module start address. STEP 7 assigns the channel addresses automatically during configuration. Based on the module start addresses, STEP 7 assigns the channel addresses in ascending order (in the following figure, the module start address is 256). When you insert an analog electronic module into a free slot, STEP 7 assigns a default address. You can change the proposed default address in STEP Operating Instructions, 12/2017, A5E AB

44 Configuring 5.2 Configuring the CPU Example of the assignment of addresses to channels (analog electronic module) The following figure shows how the addresses of the individual channels arise using the analog electronic module 4 AI RTD High Feature as an example. Figure 5-10 Example of the assignment of addresses to channels (analog electronic module) Note You can assign symbolic names to the addresses at the following locations in STEP 7: PLC tag table Properties of the module in the "IO Tags" tab. Operating Instructions, 12/2017, A5E AB 43

45 Configuring 5.2 Configuring the CPU Address space using the analog electronic module 4 AI RTD High Feature as an example Figure 5-11 Address space 4 AI RTD High Feature Reference You can find additional information on addressing and address allocation in the operating instructions of the ET 200pro distributed I/O system ( and in the STEP 7 online help Process images and process image partitions Process image - overview Process image of the inputs and outputs The process images of the inputs and outputs is a map of the signal states. The CPU transfers the values from the input and output modules into the process image of the inputs and outputs. At the start of the cyclic program, the CPU transfers the signal states of the input modules to the process image input. At the end of the cyclic program, the CPU transfers the process image output as a signal state to the output modules. Advantages of the process image A process image allows you to access a consistent image of process signals during cyclic program execution. If a signal state at an input module changes during program processing, the signal state is retained in the process image. The CPU does not update the process image until the next cycle. 44 Operating Instructions, 12/2017, A5E AB

46 Configuring 5.2 Configuring the CPU 32 process image partitions By means of process image partitions, the CPU synchronizes the updated inputs/outputs of particular modules with defined user program sections. For the CPU 1516pro-2 PN, the overall process image is subdivided into up to 32 process image partitions (PIP). The CPU updates PIP 0 (automatic update) automatically in each program cycle and assigns it to OB 1. You can assign the process image partitions PIP 1 to PIP 31 to the other OBs during configuration of the input/output modules. After the OB has been started, the CPU updates the assigned process image partition for inputs and reads in the process signals. At the end of the OB the CPU writes the outputs of the assigned process image partition directly to the peripheral outputs without having to wait for the completion of the cyclic program processing Assign process image partitions to an OB Update process image partition You can assign a process image partition to an OB. In this case, the process image partition is automatically updated. The CPU always reads the process image partition of the inputs (PIPI) before processing of the associated OB and always outputs the process image partition of the outputs (PIPO) at the end of the OB. The following figure illustrates the updating of a process image partition. Figure 5-12 Update process image partitions Operating Instructions, 12/2017, A5E AB 45

47 Configuring 5.2 Configuring the CPU Update process image partitions in the user program Requirements As an alternative to the methods described above, you can use the "UPDAT_PI" or "UPDAT_PO" instruction at the start or end of the respectively assigned OB to update the process image. These instructions are available in STEP 7 on the "Instructions" task card under "Extended instructions" and may be called from any point in the program. Requirements for updating process image partitions with the "UPDAT_PI" and "UPDAT_PO" instructions: The process image partitions cannot be assigned to any OB, i.e. they cannot be automatically updated. Note Updating PIP 0 PIP 0 (automatic update) cannot be updated with the "UPDAT_PI" and "UPDAT_PO" instructions. UPDAT_PI: Update process image partition of the inputs With this instruction you read the signal states from the input modules into the process image partition of the inputs (PIPI). UPDAT_PO: Update process image partition of the outputs With this instruction you transmit the process image partition of the outputs to the output modules. Isochronous mode interrupt OBs In synchronous cycle interrupt OBs you use the "SYNC_PI" and "SYNC_PO" instructions to update the process image partitions. Additional information on isochronous mode interrupt OBs is available in the STEP 7 online help. Direct I/O access to the inputs and outputs of the module You also have direct read and write access to the I/O, as an alternative to access via the process image, should direct access be required for programming reasons. A direct (write) I/O access also writes the process image. This prevents the situation where a subsequent output of the process image overwrites the value written via direct access again. Reference Additional information on process image partitions is available found in the function manual, Cycle and response times ( 46 Operating Instructions, 12/2017, A5E AB

48 Basics of program execution Events and OBs Response to triggers The occurrence of a trigger results in the following reaction: If the event comes from an event source to which you have assigned an OB, this event triggers the execution of the assigned OB. The event enters the queue according to its priority. If the event comes from an event source to which you have not assigned an OB, the CPU executes the default system reaction. Note Some event sources, such as startup, pull/plug, exist even if you do not configure them. Triggers The table below provides an overview of: Possible event sources Possible values for the OB priority Possible OB numbers Default system reaction Number of OBs Table 6-1 Triggers Types of event sources Possible priorities (default Possible OB numbers Default system Number of OBs priority) reaction 1) Startup 2) 1 100, 123 Ignore 0 to 100 Cyclic program 2) 1 1, 123 Ignore 0 to 100 Time-of-day interrupt 2) 2 to 24 (2) 10 to 17, 123 Not applicable 0 to 20 Time-delay interrupt 2) 2 to 24 (3) 20 to 23, 123 Not applicable 0 to 20 Cyclic interrupt 2) 2 to 24 (8 to 17, frequency 30 to 38, 123 Not applicable 0 to 20 dependent) Hardware interrupt 2) 2 to 26 (18) 40 to 47, 123 Ignore 0 to 50 3) Status interrupt 2 to 24 (4) 55 Ignore 0 or 1 Update interrupt 2 to 24 (4) 56 Ignore 0 or 1 Manufacturer-specific or profile-specific interrupt 2 to 24 (4) 57 Ignore 0 or 1 Operating Instructions, 12/2017, A5E AB 47

49 Basics of program execution 6.1 Events and OBs Types of event sources Possible priorities (default priority) Possible OB numbers Default system reaction 1) Isochronous mode interrupt 16 to 26 (21) 61 to 64, 123 Ignore 0 to 2 Time error 4) Ignore 0 or 1 Maximum cycle time exceeded once STOP Diagnostics interrupt 2 to 26 (5) 82 Ignore 0 or 1 Removal/insertion of modules 2 to 26 (6) 83 Ignore 0 or 1 Rack error 2 to 26 (6) 86 Ignore 0 or 1 MC servo 5) 17 to 26 (25) 91 Not applicable 0 or 1 MC pre-servo 5) 17 to 26 (25) 67 Not applicable 0 or 1 MC post-servo 5) 17 to 26 (25) 95 Not applicable 0 or 1 MC interpolator 5) 16 to 26 (24) 92 Not applicable 0 or 1 Programming error (only for global error handling) I/O access error (only for global error handling) 1) If you have not configured the OB. 2 to 26 (7) 121 STOP 0 or 1 2 to 26 (7) 122 Ignore 0 or 1 Number of OBs 2) For these event sources, apart from the permanently assigned OB numbers (see column: possible OB numbers), you can also assign OB numbers in STEP 7 from the range ) You can assign a maximum of one hardware interrupt OB to each I/O module in STEP 7. The start information is displayed in the hardware interrupt OB in the TIA Portal the same as in S7-300/S You can find additional information on the start information in the STEP 7 online help. 4) If the maximum cycle time has been exceeded twice within a cycle, the CPU always switches to STOP regardless of whether you have configured OB 80. 5) You can find additional information about these event sources and the runtime behavior in the S Motion Control function manual. Assignment between event source and OBs The type of OB determines where you make the assignment between OB and event source: With hardware interrupts and isochronous mode interrupts, the assignment is made during the configuration of the hardware or when the OB is created. For MC-Servo, MC-PreServo, MC-PostServo and MC-Interpolator, STEP 7 automatically assigns OBs 91/92 as soon as a technology object is added. For all other types of OB, the assignment is made when the OB is created, where applicable after you have configured the event source. For hardware interrupts, you can change an assignment which has already been made during runtime with the instructions ATTACH and DETACH. In this case, only the actually effective assignment changes, and not the configured assignment. The configured assignment takes effect after loading, and upon each startup. The CPU ignores hardware interrupts to which you did not assign an OB in your configuration or which occur after the DETACH instruction. The CPU does not check whether an OB is assigned to this event when the event arrives, but only before the actual processing of the hardware interrupt. 48 Operating Instructions, 12/2017, A5E AB

50 Basics of program execution 6.1 Events and OBs OB priority and runtime behavior If you have assigned an OB to the event, the OB has the priority of the event. The CPU supports the priorities 1 (lowest priority) to 26 (highest priority). The following items are essential to the execution of an event: Call and execution of the assigned OB The update of the process image partition of the assigned OB The user program processes the OBs exclusively on a priority basis. This means the program processes the OB with the highest priority first when multiple OB requests occur at the same time. If an event occurs that has a higher priority than the currently active OB, this OB is interrupted. The user program processes events of the same priority in order of occurrence. Note Communication The communication (e.g. test functions with the PG) always works with priority 15. To prevent extending the program runtime unnecessarily in time-critical applications, these OBs should not be interrupted by communication. Assign a priority > 15 for these OBs. Reference You can find additional information on organization blocks in the STEP 7 online help. Operating Instructions, 12/2017, A5E AB 49

51 Basics of program execution 6.2 CPU overload behavior 6.2 CPU overload behavior Requirements For the event scenarios considered in the following section, it is assumed that you have assigned an OB to each event source and that these OBs have the same priority. The second condition, in particular, is only for the sake of a simplified representation. Principle of CPU overload behavior An occurring event triggers the execution of the associated OB. Depending on the OB priority and the current processor load, a time delay may occur before the OB is executed when there is an overload. The same event can therefore occur once or several times before the user program processes the OB belonging to the preceding event. The CPU treats such a situation as follows: The operating system queues the events in the queue associated with their priority in the order of their occurrence. To control temporary overload situations, you can limit the number of queued events that originate from the same source. The next event is discarded as soon as the maximum number of pending triggers of a specific cyclic interrupt OB, for example, is reached. An overload occurs when events which originate from the same source occur faster than they can be processed by the CPU. More detailed information is provided in the following sections. Discarding similar events or fetching them later Below, the term "similar events" refers to events from a single source, such as triggers for a specific cyclic interrupt OB. The OB parameter "Events to be queued" is used to specify how many similar events the operating system places in the associated queue and therefore post-processes. If this parameter has the value 1, for example, exactly one event is stored temporarily. Note Post-processing of cyclic events is often not desirable, as this can lead to an overload with OBs of the same or lower priority. Therefore, it is generally advantageous to discard similar events and to react to the overload situation during the next scheduled OB processing. If the value of the "Events to be queued" parameter is low, this ensures that an overload situation is mitigated rather than aggravated. If the maximum number of triggers is reached in the queue for a cyclic interrupt OB (Cyclic interrupt), for example, each additional trigger is only counted and subsequently discarded. During the next scheduled execution of the OB, the CPU provides the number of discarded triggers in the "Event_Count" input parameter (in the start information). You can then react appropriately to the overload situation. The CPU then sets the counter for lost events to zero. If the CPU, for example, first discards a trigger for a cyclic interrupt OB, its further behavior depends on the OB parameter "Report event overflow into diagnostic buffer": If the check box is selected, the CPU enters the event DW#16#0002:3507 once in the diagnostics buffer for the overload situation at this event source. The CPU suppresses additional diagnostics buffer entries of the event DW#16#0002:3507 until all events from this source have been post-processed. 50 Operating Instructions, 12/2017, A5E AB

52 Basics of program execution 6.2 CPU overload behavior Threshold mechanism for time error OB request The OB parameter "Enable time error" is used to specify whether the time error OB is to be called at a defined overload for similar events. You can find the OB parameter "Enable time error" in the properties of the OB in the "Attributes" category. When you enable the time error OB (check box selected), use the OB parameter "Event threshold for time error" to specify the number of similar events in the queue as of which the time error OB is called. If this parameter has the value 1, for example, the CPU enters the event DW#16#0002:3502 once in the diagnostics buffer and requests the time error OB when the second event occurs. The CPU suppresses additional diagnostics buffer entries of the event DW#16#0002:3502 until all events from this source have been post-processed. In the event of an overload, you therefore have the option of programming a reaction well before the limit is reached for similar events and thus before the events are discarded. The following value range applies to the "Event threshold for time error" parameter: 1 "Event threshold for time error" "Events to be queued". Operating Instructions, 12/2017, A5E AB 51

53 Basics of program execution 6.3 Asynchronous instructions 6.3 Asynchronous instructions Difference between synchronous and asynchronous instructions Program processing differentiates between instructions operating synchronously and asynchronously. The "synchronous" and "asynchronous" properties relate to the temporal relationship between the call and execution of the instruction. The following applies to synchronous instructions: When the call of a synchronous instruction is complete, execution of the instruction is also complete. This is different in the case of asynchronous instructions: When the call of an asynchronous instruction is complete, execution of the asynchronous instruction is not necessarily complete yet. This means the execution of an asynchronous instruction can extend over multiple calls. The CPU processes asynchronous instructions in parallel with the cyclic user program. Asynchronous instructions generate jobs in the CPU for their processing. Asynchronous instructions are usually instructions for transferring data (data records for modules, communication data, diagnostic data, etc.). Processing of asynchronous instructions The figure below shows the difference between the processing of an asynchronous instruction and a synchronous instruction. In this figure, the CPU calls the asynchronous instruction five times before its execution is complete, e.g. a data record has been completely transferred First call of the asynchronous instruction, start of execution Intermediate call of the asynchronous instruction, execution continues Last call of the asynchronous instruction, completion of execution The synchronous instruction is completely executed at each call Duration of complete execution Figure 6-1 Difference between asynchronous and synchronous instructions 52 Operating Instructions, 12/2017, A5E AB

54 Basics of program execution 6.3 Asynchronous instructions Parallel processing of asynchronous instruction jobs A CPU can process several asynchronous instruction jobs in parallel. The CPU processes the jobs in parallel under the following conditions: Several asynchronous instruction jobs are called at the same time. The maximum number of simultaneously running jobs for the instruction is not exceeded. The figure below shows the parallel processing of two jobs of the WRREC instruction. The two instructions are executed simultaneously for a certain duration. Figure 6-2 Parallel processing of the asynchronous instruction WRREC Assignment of call to job of the instruction To execute an instruction over multiple calls, the CPU must be able to uniquely relate a subsequent call to a running job of the instruction. To relate a call to a job, the CPU uses one of the following two mechanisms, depending on the type of the instruction: Using the instance data block of the instruction (for "SFB" type) Using job-identifying input parameters of the instruction. These input parameters must match in each call during processing of the asynchronous instruction. Example: A job of the "Create_DB" instruction is identified by input parameters LOW_LIMIT, UP_LIMIT, COUNT, ATTRIB and SRCBLK. The following table shows which input parameters you use to identify which instruction. Instruction DPSYC_FR D_ACT_DP DPNRM_DG WR_DPARM WR_REC RD_REC CREATE_DB READ_DBL WRIT_DBL RD_DPARA DP_TOPOL Job is identified by LADDR, GROUP, MODE LADDR LADDR LADDR, RECNUM LADDR, RECNUM LADDR, RECNUM LOW_LIMIT, UP_LIMIT, COUNT, ATTRIB, SRCBLK SRCBLK, DSTBLK SRCBLK, DSTBLK LADDR, RECNUM DP_ID Operating Instructions, 12/2017, A5E AB 53

55 Basics of program execution 6.3 Asynchronous instructions Status of an asynchronous instruction An asynchronous instruction shows its status via the block parameters STATUS/RET_VAL and BUSY. Many asynchronous instructions also use the block parameters DONE and ERROR. The figure below shows the two asynchronous instructions WRREC and CREATE_DB The input parameter REQ starts the job to execute the asynchronous instruction. The output parameter DONE indicates that the job was completed without error. The output parameter BUSY indicates whether the job is currently being executed. When BUSY =1, a resource is allocated for the asynchronous instruction. When BUSY = 0, the resource is free. The output parameter ERROR indicates that an error has occurred. The output parameter STATUS/RET_VAL provides information on the status of the job execution. The output parameter STATUS/RET_VAL receives the error information after the occurrence of an error. Figure 6-3 Block parameters of asynchronous instructions using the instructions WRREC and CREATE_DB as examples. 54 Operating Instructions, 12/2017, A5E AB

56 Basics of program execution 6.3 Asynchronous instructions Summary The table below provides you with an overview of the relationships described above. It shows in particular the possible values of the output parameters if execution of the instruction is not complete after a call. Note You must evaluate the relevant output parameters in your program after each call Relationship between REQ, STATUS/RET_VAL, BUSY and DONE during a "running" job. Seq. no. Type of call REQ STATUS/RET_VAL BUSY DONE ERROR of the call 1 First call 1 W#16# Error code (e.g. W#16#80C3 for lack of resources) to (n - 1) Intermediate call Not relevant n Last call Not relevant W#16# W#16#0000, if no errors have occurred. Error code if errors occurred Use of resources Asynchronous instructions use resources in the CPU during their execution. The resources are limited depending on the instruction. The CPU can simultaneously process only a maximum number of asynchronous instruction jobs. The resources are available again after a job has been processed successfully or with errors. Example: For the RDREC instruction, a CPU 1516pro-2 PN can process up to 20 jobs in parallel. If the maximum number of simultaneous jobs for an instruction is exceeded, the instruction returns the error code 80C3 (lack of resources) in the block parameter STATUS. The CPU does not execute the job until a resource becomes available again. Note Lower-level asynchronous instructions Some asynchronous instructions use one or more lower-level asynchronous instructions for their processing. This dependence is shown in the tables below. Please note that with multiple lower-level instructions, only one lower-level resource is typically allocated at a time. Operating Instructions, 12/2017, A5E AB 55

57 Basics of program execution 6.3 Asynchronous instructions Extended instructions: maximum number of simultaneously running jobs The following table shows the maximum number of simultaneously running jobs for asynchronous extended instructions. Extended instructions CPU 1516pro-2 PN Distributed I/O RDREC 20 RD_REC 10 WRREC 20 WR_REC 10 D_ACT_DP 8 ReconfigIOSystem uses RDREC, WRREC, D_ACT_DP, DPSYC_FR 2 DPNRM_DG 8 DP_TOPOL 1 ASI_CTRL uses RDREC, WRREC PROFIenergy PE_START_END uses RDREC, WRREC PE_CMD uses RDREC, WRREC PE_DS3_Write_ET200 uses RDREC, WRREC S PE_WOL uses RDREC, WRREC, TUSEND, TURCV, TCON, TDISCON Module parameter assignment RD_DPAR 10 RD_DPARA 10 RD_DPARM 10 WR_DPARM 10 Diagnostics Get_IM_Data 10 GetStationInfo 10 Recipes and data logging RecipeExport 10 RecipeImport 10 DataLogCreate 10 DataLogOpen 10 DataLogWrite 10 DataLogClear 10 DataLogClose 10 DataLogDelete 10 DataLogNewFile Operating Instructions, 12/2017, A5E AB

58 Basics of program execution 6.3 Asynchronous instructions Extended instructions CPU 1516pro-2 PN Data block functions CREATE_DB 10 READ_DBL 10 WRIT_DBL 10 DELETE_DB 10 File handling FileReadC 10 FileWriteC 10 Basic instructions: maximum number of simultaneously running jobs The following table shows the maximum number of simultaneously running jobs for asynchronous basic instructions. Basic instructions Array DB ReadFromArrayDBL WriteToArrayDBL CPU 1516pro-2 PN uses READ_DBL (see Extended instructions) uses READ_DBL, WRIT_DBL (see Extended instructions) Communication: maximum number of simultaneously running jobs The following table shows the maximum number of simultaneously running jobs for asynchronous instructions (Open User Communication) for the CPU. Open User Communication CPU 1516pro-2 PN TSEND 256 TUSEND TRCV 256 TURCV TCON 256 TDISCON 256 T_RESET 256 T_DIAG 256 T_CONFIG 1 TSEND_C uses TSEND, TUSEND, TRCV, TCON, TDISCON TRCV_C uses TSEND, TUSEND, TRCV, TURCV, TCON, TDISCON TMAIL_C uses TSEND, TUSEND, TRCV, TURCV, TCON, TDISCON Operating Instructions, 12/2017, A5E AB 57

59 Basics of program execution 6.3 Asynchronous instructions The following table shows the maximum number of simultaneously running jobs for asynchronous instructions (MODBUS TCP) for the CPU. MODBUS TCP MB_CLIENT MB_SERVER CPU 1516pro-2 PN uses TSEND, TUSEND, TRCV, TURCV, TCON, TDISCON uses TSEND, TUSEND, TRCV, TURCV, TCON, TDISCON The table below shows the maximum number of simultaneously running jobs for asynchronous instructions (S7 communication) for the CPU. The S7 communication instructions use a common pool of resources. S7 communication PUT GET USEND URCV BSEND BRCV CPU 1516pro-2 PN 768 The table below shows the maximum number of simultaneously running jobs for asynchronous instructions (communications processors) for the CPU. Communications processors PtP communication Port_Config Send_Config Receive_Config Send_P2P Receive_P2P Receive_Reset Signal_Get Signal_Set Get_Features Set_Features USS communication USS_Port_Scan MODBUS (RTU) Modbus_Comm_Load ET 200S serial interface S_USSI SIMATIC NET CP FTP_CMD CPU 1516pro-2 PN uses RDDEC, WRREC uses RDDEC, WRREC uses RDDEC, WRREC uses RDDEC, WRREC uses RDDEC, WRREC uses RDDEC, WRREC uses RDDEC, WRREC uses RDDEC, WRREC uses RDDEC, WRREC uses RDDEC, WRREC uses RDDEC, WRREC uses RDDEC, WRREC uses CREATE_DB uses TSEND, TRCV, TCON, TDISCON 58 Operating Instructions, 12/2017, A5E AB

60 Basics of program execution 6.3 Asynchronous instructions The following table shows the maximum number of simultaneously running jobs for asynchronous instructions (OPC UA) for the CPU. OPC_UA CPU 1516pro-2 PN OPC_UA_Connect 10 OPC_UA_Disconnect 10 OPC_UA_Namespace 10 GetIndexList OPC_UA_NodeGetHan 10 dlelist OPC_UA_NodeRelease 10 HandleList OPC_UA_TranslatePat 10 hlist OPC_UA_Browse 10 OPC_UA_ReadList 10 OPC_UA_WriteList 10 OPC_UA_MethodGetH 10 andlelist OPC_UA_MethodRelea 10 sehandlelist OPC_UA_MethodCall 10 OPC_UA_ServerMetho 10 dpre OPC_UA_ServerMetho 10 dpost OPC_UA_ConnectionG 10 etstatus Operating Instructions, 12/2017, A5E AB 59

61 Basics of program execution 6.3 Asynchronous instructions Technology: maximum number of simultaneously running jobs The following table shows the maximum number of simultaneously running jobs for asynchronous instructions (technology). Technology Motion control MC_Power MC_Reset MC_Home MC_Halt MC_MoveAbsolute MC_MoveRelative MC_MoveVelocity MC_MoveJog MC_GearIn MC_MoveSuperimpose d MC_MeasuringInput MC_MeasuringInputCy clic MC_AbortMeasuringInp ut MC_OutputCam MC_CamTrack MC_TorqueLimiting CPU 1516pro-2 PN 1500 Reference You can find additional information on block parameter assignment in the STEP 7 online help. 60 Operating Instructions, 12/2017, A5E AB

62 Protection Overview of the protection functions Introduction This section describes the following functions for protection of the ET 200pro distributed I/O system against unauthorized access: Access protection Know-how protection Copy protection Further measures for protecting the CPU The following measures also increase the protection against unauthorized access to functions and data of the CPU 1516pro-2 PN, both externally and via the network: Deactivation of the Web server Deactivation of the OPC UA server (you can find additional information on the security mechanisms for OPC UA servers in the Communication ( Function Manual) Deactivation of the time synchronization via an NTP Server Deactivation of the PUT/GET communication When the Web server is used, you protect the ET 200pro distributed I/O system from unauthorized access: By setting password-protected access rights for specific users in the user administration. By using the preset option "Permit access only with HTTPS". The option allows access to the web server only with the secure hypertext transmission protocol HTTPS. Operating Instructions, 12/2017, A5E AB 61

63 Protection 7.2 Configuring access protection for the CPU 7.2 Configuring access protection for the CPU Introduction The CPU offers four access levels to limit access to specific functions. By setting up the access levels and the passwords for a CPU, you limit the functions and memory areas that are accessible without entering a password. The individual access levels as well as their associated passwords are specified in the object properties of the CPU. Access levels of the CPU Table 7-1 Access levels and access restrictions Access levels Complete access (no protection) Read access HMI access No access (complete protection) Access restrictions Every user can read and change the hardware configuration and the blocks. With this access level, read-only access to the hardware configuration and the blocks is possible without entering a password, which means you can download hardware configuration and blocks to the programming device. In addition, HMI access and access to diagnostics data is possible. Without entering the password, you cannot load any blocks or hardware configuration into the CPU. Additionally, the following are not possible without the password: Writing test functions and firmware update (online). With this access level only HMI access and access to diagnostics data is possible without entering the password. Without entering the password, you can neither load blocks and hardware configuration into the CPU, nor load blocks and hardware configuration from the CPU into the programming device. Additionally, the following are not possible without the password: Test functions, changing the operating mode (RUN/STOP), firmware update and display of online/offline comparison status. When the CPU has complete protection, no read or write access to the hardware configuration and the blocks is possible (without access authorization in the form of a password). HMI access is also not possible. The server function for PUT/GET communication is disabled in this access level (cannot be changed). Authentication with the password will again provide you full access to the CPU. You can find a list of which functions are possible in the various protection levels in the STEP 7 online help under the entry "Setting options for the protection". 62 Operating Instructions, 12/2017, A5E AB

64 Protection 7.2 Configuring access protection for the CPU Properties of the access levels Each access level allows unrestricted access to certain functions without entering a password, e.g. identification using the "Accessible devices" function. The CPU's default setting is "No restriction" and "No password protection". In order to protect access to a CPU, you must edit the properties of the CPU and set up a password. In the default access level "Full access (no protection)" every user can read and change the hardware configuration and the blocks. A password is not set and is also not required for online access. Communication between the CPUs (via the communication functions in the blocks) is not restricted by the access level of the CPU, unless PUT/GET communication is deactivated in the "No access" (complete protection) access level. Entry of the right password allows access to all the functions that are allowed in the corresponding level. Note Configuring an access level does not replace know-how protection The configuration of access levels offers a high degree of protection against unauthorized changes on the CPU. The access levels restrict the rights to download the hardware and software configuration to the CPU. However, blocks on the SIMATIC memory card are not write- or read-protected. Use know-how protection to protect the code of blocks on the SIMATIC memory card. Behavior of functions with different access levels You can find a tabular list of which online functions are possible in the various access levels in the STEP 7 online help. Operating Instructions, 12/2017, A5E AB 63

65 Protection 7.2 Configuring access protection for the CPU Parameterizing the procedure at access levels To set the access levels for the CPU by means of parameter assignment, follow these steps: 1. Open the properties of the CPU in the Inspector window. 2. Open the "Protection" entry in the area navigation. A table with the possible access levels appears in the Inspector window. Figure 7-1 Possible access levels 3. Activate the desired protection level in the first column of the table. The green check marks in the columns to the right of the respective access level show you which operations are still available without entering the password. In the example (see above), read access and HMI access is still possible without a password. 4. In the "Enter password" column, specify a password for the access level "Full access" in the first row. In the "Confirm password" column, enter the selected password again to guard against incorrect entries. Ensure that the password is sufficiently secure, in other words, that is does not follow a pattern that can be recognized by a machine! 5. Assign additional passwords to other access levels as needed, if the selected access level calls for this. 6. Download the hardware configuration for the access level to take effect. The CPU logs the entry of the correct or incorrect password and any changes in the configuration of the access levels by a corresponding entry in the diagnostics buffer. Behavior of a password-protected CPU during operation The CPU protection takes effect after you have downloaded the settings to the CPU. Before an online function is executed, STEP 7 checks the admissibility and, if password protection is configured, prompts the user to enter a password. You can only execute password-protected functions from one programming device / PC at any time. Another programming device/pc cannot log on. Access authorization to the protected data is in effect for the duration of the online connection or until you have rescinded the access authorization manually with "Online > Delete access rights". 64 Operating Instructions, 12/2017, A5E AB

66 Protection 7.3 Using the user program to set additional access protection Access levels for F-CPU For the fail-safe CPU, there is an additional access level besides the four access levels described. You can find additional information about this access level in the description of the fail-safe system SIMATIC Safety Programming and Operating Manual SIMATIC Safety - Configuring and Programming ( 7.3 Using the user program to set additional access protection Access protection by means of the user program You can also restrict access to a password-protected CPU in STEP 7 using the ENDIS_PW instruction. You can find a description of this block in the online help under the keyword "ENDIS_PW: Limit and enable password legitimation". Operating Instructions, 12/2017, A5E AB 65

67 Protection 7.4 Know-how protection 7.4 Know-how protection Application You can use know-how protection to protect one or more blocks of the OB, FB, FC type and global data blocks in your program from unauthorized access. You can enter a password to restrict access to a block. The password offers high-level protection against unauthorized reading or manipulation of the block. Password provider As an alternative to manual password entry, you can link a password provider to STEP 7. When using a password provider, you select a password from a list of available passwords. When a protected block is opened, STEP 7 connects to the password provider and retrieves the corresponding password. To connect a password provider, you have to install and activate the password provider. A settings file in which you specify the use of a password provider is also required. A password provider provides the following advantages: The password provider defines and manages the passwords. When opening know-how protected blocks, you work with symbolic names for passwords. A password is, for example, identified with the symbolic name "Machine_1" in the password provider. The actual password behind "Machine_1" remains hidden to you. This means that a password provider offers you optimal block protection because operators do not know the actual password. STEP 7 opens know-how protected blocks automatically without direct password entry. This saves you time. You can find more information on integrating a password provider in the STEP 7 online help. Readable data If a block is know-how protected, only the following data is readable without the correct password: Block title, comments and block properties Block parameters (INPUT, OUTPUT, IN, OUT, RETURN) Call structure of the program Global tags without information on the point of use 66 Operating Instructions, 12/2017, A5E AB

68 Protection 7.4 Know-how protection Further actions Further actions that can be carried out with a know-how protected block: Copying and deleting Calling within a program Online/offline comparison Load Global data blocks and array data blocks You can provide global data blocks (global DBs) with know-how protection. Users who do not possess the valid password can read the global data block but not change it. You cannot provide array data blocks (array DBs) with know-how protection. Setting up block know-how protection To set up block know-how protection, follow these steps: 1. Open the properties of the respective block. 2. Select the "Protection" option under "General". Figure 7-2 Setting up block know-how protection (1) 3. Click the "Protection" button to display the "Know-how protection" dialog. Figure 7-3 Setting up block know-how protection (2) Operating Instructions, 12/2017, A5E AB 67

69 Protection 7.4 Know-how protection 4. Click the "Define" button to open the "Define password" dialog. Figure 7-4 Setting up block know-how protection (3) 5. Enter the new password in the "New password" field. Enter the same password in the "Confirm password" field. 6. Click "OK" to confirm your entry. 7. Close the "Know-how protection" dialog by clicking "OK". Result: The blocks selected will be know-how-protected. Know-how protected blocks are marked with a lock symbol in the project tree. The password entered applies to all blocks selected. Note Password provider Alternatively, you can configure know-how protection for blocks with a password provider. Opening know-how protected blocks To open a know-how protected block, follow these steps: 1. Double-click the block to open the "Access protection" dialog. 2. Enter the password for the know-how protected block. 3. Click "OK" to confirm your entry. Result: The know-how-protected block opens. Once you have opened the block, you can edit the program code and the block interface of the block for as long as the block or STEP 7 is open. You must enter the password again the next time you open the block. If you close the "Access protection" dialog with "Cancel", the block will open but the block code will not be displayed and you will not be able to edit the block. If you copy the block or add it to a library, for example, this does not cancel the know-how protection of the block. The copies will also be know-how-protected. 68 Operating Instructions, 12/2017, A5E AB

70 Protection 7.4 Know-how protection Removing block know-how protection To remove block know-how protection, follow these steps: 1. Select the block from which you want to remove know-how protection. The protected block must not be open in the program editor. 2. In the "Edit" menu, select the "Know-how protection" command to open the "Know-how protection" dialog. 3. Clear the "Hide code (Know-how protection)" check box. Figure 7-5 Removing block know-how protection (1) 4. Enter the password. Figure 7-6 Removing block know-how protection (2) 5. Click "OK" to confirm your entry. Result: Know-how protection is removed for the selected block. Operating Instructions, 12/2017, A5E AB 69

71 Protection 7.5 Copy protection 7.5 Copy protection Application The copy protection allows you to protect your program against unauthorized duplication. Copy protection allows you to link the program or the blocks to a specific SIMATIC memory card or CPU. Through the association with the serial number of a SIMATIC memory card or CPU, you make the use of this program or block only possible in combination with a specific SIMATIC memory card or CPU. Copy and know-how protection Recommendation: To prevent an unauthorized reset of the copy protection, provide a copyprotected block with additional know-how protection. First set up the copy protection for the block and after this the know-how protection. Setting up copy protection To set up copy protection, follow these steps: 1. Open the properties of the respective block. 2. Select the "Protection" option under "General". Figure 7-7 Setting up copy protection (1) 3. In the "Copy protection" area, select either the "Bind to serial number of the CPU" entry or the "Bind to serial number of the memory card" entry from the drop-down list. Figure 7-8 Setting up copy protection (2) 70 Operating Instructions, 12/2017, A5E AB

72 Protection 7.5 Copy protection 4. Activate the option "Serial number is inserted when downloading to a device or a memory card" if STEP 7 is to automatically insert the serial number during the upload process (dynamic binding). Assign a password using the "Define password" to link the use of a block/program additionally to the input of a password. If you want to manually bind the serial number of the CPU or the SIMATIC memory card to a block activate the option "Enter serial number" (static binding). 5. You can now set up the know-how protection for the block in the "Know-how protection" area. Note If you download a copy-protected block to a device that does not match the specified serial number, the entire download operation is not possible. This means that you also cannot download blocks without copy protection. Removing copy protection To remove copy protection, follow these steps: 1. Remove any existing Know-how protection (Page 66). 2. Open the properties of the respective block. 3. Select the "Protection" option under "General". 4. In the "Copy protection" area, select the "No binding" entry from the drop-down list. Figure 7-9 Removing copy protection Operating Instructions, 12/2017, A5E AB 71

73 Commissioning Overview Introduction This section includes information on the following topics: Commissioning the CPU 1516pro-2 PN on PROFINET IO Removing/inserting the SIMATIC memory card Operating modes of the CPU CPU memory reset Identification and maintenance data Commissioning requirements Note Performing tests You must ensure the safety of your plant. You therefore need to perform a complete functional test and the necessary safety checks before the final commissioning of a plant. Also allow for any possible foreseeable errors in the tests. This avoids endangering persons or equipment during operation. PRONETA With SIEMENS PRONETA (PROFINET network analysis), you analyze the system network during commissioning. PRONETA features two core functions: The topology overview independently scans PROFINET and all connected components. The IO check is a fast test of the wiring and the module configuration of a plant. You can find SIEMENS PRONETA on the Internet ( 72 Operating Instructions, 12/2017, A5E AB

74 Commissioning 8.1 Overview SIMATIC Automation Tool You can use the SIMATIC Automation Tool to perform commissioning and maintenance activities simultaneously on various SIMATIC S7 stations as a bulk operation independent of the TIA Portal. General function overview: Network browsing and creation of a table showing the accessible devices in the network. Flashing of device LEDs or HMI display to locate a device Downloading of addresses (IP, subnet, gateway) to a device Downloading the PROFINET name (station name) to a device Placing a CPU in RUN or STOP mode Setting the time in a CPU to the current time of your programming device/pc Downloading a new program to a CPU or an HMI device Downloading from CPU, downloading to CPU or deleting recipe data from a CPU Downloading from CPU or deleting data log data from a CPU Backup/restore of data from/to a backup file for CPUs and HMI devices Downloading service data from a CPU Reading the diagnostics buffer of a CPU Performing a CPU memory reset Resetting devices to factory settings Downloading a firmware update to a device You can find the SIMATIC Automation Tool on the Internet ( Operating Instructions, 12/2017, A5E AB 73

75 Commissioning 8.2 Procedure for commissioning the ET 200pro distributed I/O system with CPU 8.2 Procedure for commissioning the ET 200pro distributed I/O system with CPU Introduction PROFINET IO Requirements The CPU is in the "Factory settings" state or has been reset to factory settings (see section Resetting the CPU to factory settings (Page 110)). The SIMATIC memory card is as delivered or has been formatted. At the startup of the station with CPU 1516pro-2 PN, the installation must be complete, i.e. all bus, electronic, and connection modules and the termination module must be mounted. Note Interfaces for operation of the CPU as IO controller or IO device You can operate the CPU 1516pro-2 PN via both interfaces (X1 and X2) as an IO controller or IO device. 74 Operating Instructions, 12/2017, A5E AB

76 Commissioning 8.2 Procedure for commissioning the ET 200pro distributed I/O system with CPU CPU as IO controller Configuration example The following configuration example shows the use of the ET 200pro distributed I/O system with the CPU 1516pro-2 PN as an IO controller. Figure 8-1 CPU 1516pro-2 PN as IO controller Commissioning procedure To commission the ET 200pro distributed I/O system as an IO controller on PROFINET IO, we recommend the following procedure: Table 8-1 Procedure for commissioning the ET 200pro as an IO controller on PROFINET IO Step Procedure See... 1 Mounting ET 200pro (with CPU 1516pro-2 PN) Section Mounting and connecting (Page 23) 2 Inserting the SIMATICmemory card into IO controller 3 Connecting the ET 200pro Supply voltages PROFINET IO Sensors and actuators Operating instructions ET 200pro Distributed I/O System ( w/ ) Section Inserting/replacing SIMATIC memory card (Page 79) Section Mounting and connecting (Page 23) Operating instructions ET 200pro Distributed I/O System ( w/ ) 4 Configuring the IO controller 1 Section Configuring the CPU (Page 33) Operating Instructions, 12/2017, A5E AB 75

77 Commissioning 8.2 Procedure for commissioning the ET 200pro distributed I/O system with CPU Step Procedure See... 5 Switch on supply voltages for the IO controller Section Mounting and connecting (Page 23) 6 Switch on supply voltages for IO devices Documentation of the IO device 7 Download configuration to the IO controller STEP 7 online help 8 Switch IO controller to RUN mode Section RUN mode (Page 84) 9 Check LEDs Section Interrupts, diagnostics, error messages and system events (Page 121) 10 Test inputs and outputs The following functions are helpful: Monitoring and modifying tags, testing with program status, forcing, controlling the outputs. See section Test functions and fault resolution (Page 113) 1 The IO devices are configured with the IO controller. 76 Operating Instructions, 12/2017, A5E AB

78 Commissioning 8.2 Procedure for commissioning the ET 200pro distributed I/O system with CPU CPU as I-device Configuration example The following configuration example shows the use of the ET 200pro distributed I/O system with the CPU 1516pro-2 PN as an I-device. Figure 8-2 CPU 1516pro-2 PN as I-device Commissioning procedure To commission the ET 200pro distributed I/O system as an I-device on PROFINET IO, we recommend the following procedure: Table 8-2 Procedure for commissioning the ET 200pro as an I-device on PROFINET IO Step Procedure See... 1 Mounting ET 200pro (with CPU 1516pro-2 PN) Section Mounting and connecting (Page 23) Operating instructions ET 200pro Distributed I/O System ( ) 2 Inserting the SIMATIC memory card into the I-device Section Inserting/replacing SIMATIC memory card (Page 79) Operating Instructions, 12/2017, A5E AB 77

79 Commissioning 8.2 Procedure for commissioning the ET 200pro distributed I/O system with CPU Step Procedure See... 3 Connecting the ET 200pro Supply voltages PROFINET IO Sensors and actuators Operating instructions ET 200pro Distributed I/O System ( ) 4 Configuring the I-device Section Configuring the CPU (Page 33) 5 Switch on supply voltages for the IO controller Documentation of the IO controller 6 Switch on supply voltages for I-device and IO devices 7 Download configuration to the I-device STEP 7 online help Section Mounting and connecting (Page 23) and documentation of the IO devices 8 Switch IO controller and I-device to RUN mode Documentation of the IO controller and section RUN mode (Page 84) 9 Check LEDs Section Interrupts, diagnostics, error messages and system events (Page 121) 10 Test inputs and outputs The following functions are helpful: Monitoring and modifying tags, testing with program status, forcing, controlling the outputs. See section Test functions and fault resolution (Page 113) 78 Operating Instructions, 12/2017, A5E AB

80 Commissioning 8.3 Inserting/replacing SIMATIC memory card 8.3 Inserting/replacing SIMATIC memory card The SIMATIC memory card as memory module The CPU uses a SIMATIC memory card as a memory module. You can use the SIMATIC memory card as load memory or as a portable storage medium. Note An inserted SIMATIC memory card is required to operate the CPU. The SIMATIC memory card is not included in the scope of delivery of the CPU. WARNING User program of the SIMATIC memory card Ensure that the SIMATIC memory card to be inserted contains the correct user program for the CPU (for the system). The wrong user program may have fatal processing effects. Inserting/replacing the SIMATIC memory card 1. First, switch the CPU to STOP mode. 2. Loosen the 4 screws of the connection module CM CPU 2PN M12, 7/8" and remove it from the CPU. NOTICE Switching off outputs To prevent damage to the ET 200pro, you must switch off the electronic/encoder supply 1L+ and the load voltage supply 2L+ before removing connection modules. 3. Is a SIMATIC memory card already inserted? If so, gently push the SIMATIC memory card into the card slot to release the locking mechanism. You can then remove the SIMATIC memory card. 4. Insert the ("new") SIMATIC memory card into the card reader until the memory card latches. Ensure that the angled corner of the medium card is on the left side. Operating Instructions, 12/2017, A5E AB 79

81 Commissioning 8.3 Inserting/replacing SIMATIC memory card 5. Insert the connection module onto the CPU again and screw it into place. 6. Perform a memory reset (see section "CPU memory reset (Page 87)"). Figure 8-3 Inserting/replacing the SIMATIC memory card Only remove the SIMATIC memory card in POWER OFF mode of the CPU. Ensure that no writing functions (online functions with the programming device, e.g. loading/deleting a block, test functions) were active before POWER OFF. Removing and inserting a SIMATIC memory card If you replace the SIMATIC memory card, the CPU recognizes A physically identical SIMATIC memory card with modified content A new SIMATIC memory card with the same content as the old SIMATIC memory card After POWER ON, the CPU automatically performs a memory reset. Reference You can find additional information on the SIMATIC memory card in the sections SIMATIC memory card (Page 98) and Accessories/spare parts (Page 140). 80 Operating Instructions, 12/2017, A5E AB

82 Commissioning 8.4 Operating modes of the CPU 8.4 Operating modes of the CPU Operating modes of the CPU Introduction Operating modes describe the states of the CPU. The following operating states are possible via the mode selector: STARTUP RUN STOP In these operating modes, the CPU can communicate, for example, via the PROFINET IO interface (X1). The status LEDs on the front side of the CPU indicate the current operating mode STARTUP mode Function Before the CPU starts to execute the cyclic user program, it executes a startup program. In the startup program, you specify initialization variables for your cyclic program by suitably programming startup OBs. That is, you can set up one or several startup OBs in your program, or none at all. Operating Instructions, 12/2017, A5E AB 81

83 Commissioning 8.4 Operating modes of the CPU Special features in Startup mode All outputs are disabled or react according to the parameter settings for the respective module: They provide a substitute value as set in the parameters or retain the last value output and bring the controlled process to a safe operating mode. The process image is initialized. The process image is not updated. In order to read the current state of inputs during STARTUP, you can access inputs by direct I/O access. In order to initialize outputs during STARTUP, you can write the values via the process image or via direct I/O access. The CPU outputs the values at the outputs during the transition to the RUN mode. The CPU always starts up in a warm restart. The non-retentive bit memories, timers and counters are initialized. The non-retentive tags in data blocks are initialized. During startup, no cycle time monitoring is running yet. The CPU processes the startup OBs in the order of the startup OB numbers. The CPU processes all programmed startup OBs regardless of the selected startup mode. If a corresponding event occurs, the CPU can start the following OBs in startup: OB 82: Diagnostics interrupt OB 83: Removal/insertion of modules OB 86: Rack error OB 121: Programming error (only for global error handling) OB 122: I/O access error (only for global error handling) You can a description of the use of global and local error handling in the STEP 7 online help. The CPU cannot start all other OBs until after the transition to RUN mode. Response when expected and actual configurations do not match The configuration downloaded to the CPU represents the expected configuration. The actual configuration is the actual physical configuration of the ET 200pro distributed I/O system. If the preset and actual configurations are different, the setting of the "Comparison preset configuration to actual configuration" parameter determines the behavior of the CPU (see section Operating mode transitions). Canceling a startup If errors occur during startup, the CPU cancels the startup and returns to STOP mode. The CPU does not perform startup or interrupts startup under the following conditions: You have not inserted a SIMATIC memory card or an invalid one is inserted. You have not downloaded a hardware configuration to the CPU. 82 Operating Instructions, 12/2017, A5E AB

84 Commissioning 8.4 Operating modes of the CPU Parameter assignment of startup behavior You can assign parameters for the behavior of the CPU in the Startup group of the CPU properties. Setting the startup behavior To set the startup characteristics, follow these steps: 1. Select the CPU in the device view of the hardware network editor of STEP In the properties under "General" select the "Startup" area. Figure 8-4 Setting the startup characteristics 1 Sets the startup type after POWER ON 2 Defines the startup behavior for the case where a module in a slot does not correspond to the configured module. This parameter applies to the CPU and to all the modules for which you have not selected any other setting. Startup CPU only if compatible: In this setting a module on a configured slot has to be compatible with the configured module. Compatible means that the module matches the number of inputs and output and must match with respect to its electrical and functional properties. Startup CPU even if mismatch: At this setting the CPU starts up irrespective of the type of module plugged. 3 Specifies a maximum period (default: ms) in which the I/O must be ready for operation. The CPU changes to RUN. If the central and distributed I/O are not ready for operation within the configuration time, the startup characteristics of the CPU depend on the setting of the "Comparison preset to actual configuration" parameter. Operating Instructions, 12/2017, A5E AB 83

85 Commissioning 8.4 Operating modes of the CPU Example for the "Comparison preset to actual configuration" parameter "Startup CPU only if compatible" The pin assignment and all electrical and functional properties must match. "Startup CPU even if mismatch" Instead of a configured digital input module, you insert an analog output module or no module is present in this slot and thus in all subsequent slots. Although the configured inputs cannot be accessed, the CPU starts up. Note that the user program cannot function correctly in this case and take the appropriate measures STOP mode Function The CPU does not execute the user program in STOP mode. All outputs are disabled or react according to the parameter settings for the respective module: They provide a substitute value as set in the parameters or retain the last value output and thus hold the controlled process in a safe operating mode RUN mode Function In "RUN" mode the cyclic, time-driven, and interrupt-driven program execution is performed. The CPU automatically updates addresses located in the "Automatic Update" process image in each program cycle, see also section Process images and process image partitions (Page 44). Execution of the user program Once the CPU has read the inputs, the cyclic program is executed from the first instruction to the last instruction. Events with higher priority, such as hardware interrupts, diagnostic interrupts and communication, interrupt the cyclic program flow and lengthen the cycle time. If you have configured a minimum cycle time, the CPU will not end the cycle until this minimum cycle time has expired, even if the CPU has executed the user program in a shorter period. The operating system monitors the execution time of the cyclic program for a configurable upper limit known as the maximum cycle time. You can restart this time monitoring at any point in your program by calling the RE_TRIGR instruction. If the cyclic program exceeds the maximum cycle time, the operating system will attempt to start the time error OB (OB 80). If the OB is not present, the CPU ignores that the maximum cycle time was exceeded. If the cyclic program exceeds the cycle monitoring time a second time, for example while the time error OB is being processed, the CPU goes to STOP mode. Reference Additional information about cycle and response times is available in the Function Manual Cycle and response times ( 84 Operating Instructions, 12/2017, A5E AB

86 Commissioning 8.4 Operating modes of the CPU Operating mode transitions Operating modes and operating mode transitions The following figure shows the operating modes and the operating mode transitions: Figure 8-5 Operating modes and operating mode transitions The table below shows the effects of the operating mode transitions: Table 8-3 Operating mode transitions No. Operating mode transitions Effects 1 POWER ON STARTUP After switching on, the CPU switches to "STARTUP" mode if: The hardware configuration and program blocks are consistent. Startup type "Warm restart - RUN" is set or Startup type "Warm restart mode before POWER OFF" is set and the CPU was in RUN mode before POWER OFF. The CPU clears the non-retentive memory, and resets the content of non-retentive DBs to the start values of the load memory. Retentive memory and retentive DB contents are retained. The 500 most recent entries are retained in the diagnostics buffer. 2 POWER ON STOP After switching on, the CPU goes to "STOP" mode if: The hardware configuration and program blocks are inconsistent or The "No restart" startup type is set. or The CPU clears the non-retentive memory, and resets the content of non-retentive DBs to the start values of the load memory. Retentive memory and retentive DB contents are retained. The 500 most recent entries are retained in the diagnostics buffer. Startup type "Warm restart mode before POWER OFF" is set and the CPU was in RUN mode before POWER OFF. Operating Instructions, 12/2017, A5E AB 85

87 Commissioning 8.4 Operating modes of the CPU No. Operating mode transitions Effects 3 STOP STARTUP The CPU switches to "STARTUP" mode if: The hardware configuration and program blocks are consistent. You set the CPU to "RUN" mode via the programming device and the mode switch in is RUN position. or You set the mode switch from STOP to RUN. 4 STARTUP STOP The CPU returns to the "STOP" mode in the following cases of "STARTUP": The CPU detects an error during startup You set the the CPU to "STOP" via the programming device or mode switch. The CPU executes a STOP command in the Startup OB. 5 STARTUP RUN The CPU goes to the "RUN" mode in the following cases of "START-UP": The CPU has initialized the PLC tags. The CPU has executed the startup blocks successfully. 6 RUN STOP The CPU returns to the "STOP" mode in the following cases of "RUN": The CPU recognizes an error that prevents further execution. The CPU executes a STOP command in the user program. You set the the CPU to "STOP" via the programming device or mode switch. The CPU clears the non-retentive memory, and resets the content of non-retentive DBs to the start values of the load memory. Retentive memory and retentive DB contents are retained. The 500 most recent entries are retained in the diagnostics buffer. These operating mode transitions have no effect on data. 86 Operating Instructions, 12/2017, A5E AB

88 Commissioning 8.5 CPU memory reset 8.5 CPU memory reset Introduction Basics of a memory reset A memory reset on the CPU is possible only in the STOP mode. A memory reset returns the CPU to the "initial state". This means that: An existing online connection between your programming device/pc and the CPU is terminated. The content of the work memory and the retentive and non-retentive data (applies only to manual memory reset by the user) are deleted. The diagnostics buffer, time of day, and IP address are retained. Subsequently the CPU is initialized with the loaded project data (hardware configuration, code and data blocks, force jobs). The CPU copies this data from the load memory to the work memory. Result: If you set an IP address in the hardware configuration ("Set IP address in the project" option) and a SIMATIC memory card with the project is in the CPU, this IP address is valid after the memory reset. Data blocks no longer have current values but rather their configured start values. Force jobs remain active. How can I tell if the CPU is performing a memory reset? The RUN/STOP LED flashes yellow at 2 Hz. After completion the CPU goes into STOP mode, and the RUN/STOP LED is switched on (unchanging yellow). Operating Instructions, 12/2017, A5E AB 87

89 Commissioning 8.5 CPU memory reset Result after memory reset The following table provides an overview of the contents of the memory objects after memory reset. Table 8-4 Memory objects after memory reset Memory object Actual values of the data blocks, instance data blocks Bit memories, timers and counters Retentive tags of technology objects (e.g. adjustment values of absolute encoders) Diagnostics buffer entries IP address Device name Counter readings of the runtime meters Time of day Contents Initialized Initialized Retained Retained Retained Retained Retained Retained Automatic memory reset Possible cause of automatic memory reset The CPU executes an automatic memory reset if an error occurs that prevents normal further processing. Causes for such errors can be: User program is too large, and can't be completely loaded into work memory. The project data on the SIMATIC memory card are damaged, for example because a file was deleted. If you remove or insert the SIMATIC memory card and the backed-up retentive data differs in structure from that of the configuration on the SIMATIC memory card. 88 Operating Instructions, 12/2017, A5E AB

90 Commissioning 8.5 CPU memory reset Manual memory reset Reason for manual memory reset A memory reset of the CPU is required to reset the CPU to its "initial state". CPU memory reset The memory reset of the CPU is possible: Using the mode selector Using STEP 7 Procedure using the mode selector Note Memory reset Reset to factory settings The procedure described below also corresponds to the procedure for resetting to factory settings: Selector operation with inserted SIMATIC memory card: CPU executes a memory reset Selector operation without inserted SIMATIC memory card: CPU executes reset to factory settings To perform a memory reset of the CPU using the mode selector, follow these steps: 1. Set the mode selector to the STOP position. Result: The RUN/STOP LED lights up yellow. 2. Set the mode selector to the MRES position. Hold the selector in this position until the RUN/STOP LED lights up for the 2nd time and remains continuously lit (this takes three seconds). After this, release the switch. 3. Within the next three seconds, switch the mode selector back to the MRES position, and then back to STOP again. Result: The CPU executes memory reset. For information on resetting the CPU to factory settings, refer to the section Resetting the CPU to factory settings (Page 110). Procedure using STEP 7 To perform a memory reset of the CPU using STEP 7, follow these steps: 1. Open the "Online Tools" task card of the CPU. 2. Click the "MRES" button in the "CPU control panel" pane. 3. Click "OK" in response to the confirmation prompt. Result: The CPU is set to STOP mode and performs memory reset. Operating Instructions, 12/2017, A5E AB 89

91 Commissioning 8.6 Backing up and restoring the CPU configuration 8.6 Backing up and restoring the CPU configuration Overview of backup types Backup from online device You will make a number of changes to your plant over time, for example, add new devices, replace existing devices or adapt the user program. If these changes result in undesirable behavior, you can restore the plant to an earlier state. Before you load a changed configuration to the CPU, first use the option "Backup from online device" to create a complete backup of the current device status. Upload from device (software) With the option "Upload from device (software)", you load the software project data from the CPU to an existing CPU in the project. Upload device as new station If you are operating a new programming device/pc in the plant, the STEP 7 project that was used to create the plant configuration might not be available. In this case you can use the option "Upload device as new station" to load the device's data into a project in your PG/PC. Snapshot of the monitor values You can use the option "Snapshot of the monitor values" to backup the current values of the data block, in order to restore the current values if necessary at a later date. The table below shows the backup of CPU data depending on the selected type of backup and its specific characteristics: Backup from online device Upload from device (software) Upload device as new station Snapshot of the monitor values Actual values of all DBs (global and instance data blocks)* Blocks of the type OB, FC, FB and -- DB PLC tags -- (tag names and constant names) Technology objects -- Hardware configuration Actual values (bit memories, timers, counters)* Contents of the SIMATIC memory card Archives, recipes Entries in the diagnostics buffer Current time Properties of the type of backup Backup possible for fail-safe CPU Backup can be edited -- Backup possible in operating mode STOP RUN, STOP RUN, STOP RUN, STOP * Only the values of the tags that are set as retentive are backed up 90 Operating Instructions, 12/2017, A5E AB

92 Commissioning 8.6 Backing up and restoring the CPU configuration Reference You can find additional information on the procedure in the STEP 7 online help. Emergency address (Emergency IP) The emergency address (emergency IP address) of a CPU is intended for diagnostic and download functions, e.g. when the CPU is no longer accessible via the IP protocol after a wrong project is downloaded. For information on the emergency address, refer to an FAQ on the Internet ( Storage of multilingual project texts When you configure a CPU, texts of different categories result, e.g. Object names (names of blocks, modules, tags, etc.) Comments (for blocks, networks, watch tables, etc.) Alarms and diagnostic texts Texts are made available by the system (e.g. diagnostic buffer texts) or created during the configuration (e.g. alarms). Texts exist in the project in one language or, after a translation process, in multiple languages. You can maintain project texts in all languages available to you in the project tree (Languages & resources > Project texts). The texts produced when configuring can be downloaded to the CPU. The following texts are downloaded in the selected languages with the project data to the CPU and are also used by the Web server/cpu display: Diagnostic buffer texts (cannot be changed) Status texts for the module status (cannot be changed) Alarm texts with associated text lists Tag comments and step comments for S7 GRAPH and PLC Code Viewer Comments in watch tables The following texts are also downloaded in the selected languages with the project languages to the CPU but are not used by the Web server/cpu display: Comments in tag tables (for tags and constants) Comments in global data blocks Comments of elements in block interfaces of FBs, FCs, DBs and UDTs Network titles in blocks written in LAD, FBD or STL Block comments Network comments Comments of LAD and FBD elements Operating Instructions, 12/2017, A5E AB 91

93 Commissioning 8.6 Backing up and restoring the CPU configuration The CPU 1516pro-2 PN supports the storage of multilingual project texts in up to three different project languages. The memory space reserved for this on the CPU must be planned to be large enough. If the project texts of a particular project language exceed the reserved memory space nevertheless, the project cannot be downloaded to the CPU. The download is aborted with a notice that not enough memory space is available. If this happens, take steps to reduce the required memory space, e.g. shorten comments. The CPU 1516pro-2 PN has a reserved memory space of 7.5 MB for storage of multilingual project texts. The CPU divides the available memory space between the selected project languages because some languages require more memory space than others (e.g. Russian texts more than English texts). If you use only two project languages instead of three, a memory space of 7.5 MB is available for two project languages instead of three. Note Size of the SIMATIC memory card If the memory space needed for downloading projects exceeds the memory space on the utilized SIMATIC memory card, the download to the CPU is aborted with an error message. Ensure that your SIMATIC memory card has sufficient memory space for downloading projects. You can find information on reading out the memory usage of the CPU and the SIMATIC memory card in the Structure and Use of the CPU Memory ( Function Manual. You can find information on parameter assignment of multilingual project texts in STEP 7 in the STEP 7 online help. 92 Operating Instructions, 12/2017, A5E AB

94 Commissioning 8.7 Identification and maintenance data 8.7 Identification and maintenance data Reading out and entering I&M data I&M data I&M identification data is information which is stored on the module either as read-only data (I-data) or read/write data (M-data). Identification data (I&M0): Manufacturer information about the module that can only be read and is in part also printed on the housing of the module, for example, article number and serial number. Maintenance data (I&M1, 2, 3): Plant-dependent information, e.g. installation location. Maintenance data is created during configuration and written to the module. Note The CPU supports identification data (I&M0) only for the HF electronic modules. The I&M identification data supports you in the following activities: Checking the plant configuration Locating hardware changes in a plant Correcting errors in a plant Modules can be clearly identified online using the I&M identification data. STEP 7 allows you to read the identification I&M data (see STEP 7 online help). Options for reading out I&M data Via the user program Via STEP 7 or HMI devices Via the Web server of the CPU Procedure for reading I&M data by means of the user program To read the I&M data of the modules in the user program, use the RDREC instruction. The data record structure for distributed modules accessible via PROFINET IO is described in section Data record structure for I&M data (Page 95). Operating Instructions, 12/2017, A5E AB 93

95 Commissioning 8.7 Identification and maintenance data Procedure for reading the I&M data via STEP 7 Requirements: An online connection to the CPU must exist. To read the I&M data via STEP 7, follow these steps: 1. Select the CPU 1516pro-2 PN in the project tree and go to "Online & diagnostics". 2. Select the "General" area in the "Diagnostics" folder. Procedure for entering the maintenance data via STEP 7 STEP 7 assigns a default module name. You can enter the following information: Plant designation (I&M1) Location identifier (I&M1) Installation date (I&M2) Additional information (I&M3) To enter maintenance data via STEP 7, follow these steps: 1. In the device view of the hardware network editor of STEP 7, select the CPU, for example. 2. In the properties under "General", select the "Identification & Maintenance" area and enter the data. During the loading of the hardware configuration, the I&M data is also loaded. Procedure for reading out the I&M data via the Web server The procedure is described in detail in the Web server ( Function Manual. 94 Operating Instructions, 12/2017, A5E AB

96 Commissioning 8.7 Identification and maintenance data Data record structure for I&M data Reading I&M data records You selectively access certain identification data via Read data record (RDREC instruction). You obtain the corresponding part of the identification data under the relevant data record index. The data records are structured as follows: Table 8-5 Basic structure of data records with I&M identification data Contents Length (bytes) Coding (hex) Header information BlockType 2 I&M0: 0020H I&M1: 0021H I&M2: 0022H I&M3: 0023H BlockLength 2 I&M0: 0038H I&M1: 0038H I&M2: 0012H I&M3: 0038H BlockVersionHigh 1 01 BlockVersionLow 1 00 Identification data Identification data (see table below) I&M0/Index AFF0H: 54 I&M1/Index AFF1H: 54 I&M2/Index AFF2H: 16 I&M3/Index AFF3H: 54 Table 8-6 Data record structure for I&M identification data Identification data Access Default Explanation Identification data 0: (data record index AFF0 hex) VendorIDHigh Read (1 byte) 00H This is where the name of the manufacturer VendorIDLow Read (1 byte) 2AH is stored (42D = SIEMENS AG). Order_ID Read (20 bytes) 6ES PN00-0AB0 Article number of module (e.g. CPU) IM_SERIAL_NUMBER Read (16 bytes) - Serial number (device-specific) IM_HARDWARE_REVISION Read (2 bytes) 1 Corresponding HW version IM_SOFTWARE_REVISION Read Firmware version Provides information about the firmware SWRevisionPrefix (1 byte) V version of the module IM_SWRevision_Functional_ Enhancement (1 byte) 00 - FFH IM_SWRevision_Bug_Fix (1 byte) 00 - FFH IM_SWRevision_Internal_ Change (1 byte) 00 - FFH Operating Instructions, 12/2017, A5E AB 95

97 Commissioning 8.7 Identification and maintenance data Identification data Access Default Explanation IM_REVISION_COUNTER Read (2 bytes) 0000H Provides information about parameter changes on the module (not used) IM_PROFILE_ID Read (2 bytes) 0000H Generic Device IM_PROFILE_SPECIFIC_TYPE Read (2 bytes) 0001H CPU 0003H Modules IM_VERSION Read 0101H Provides information on the version of the identification data IM_Version_Major (1 byte) (0101H = Version 1.1) IM_Version_Minor (1 byte) IM_SUPPORTED Read (2 bytes) 000EH Provides information about the available identification data (I&M1 to I&M3) Maintenance data 1: (data record index AFF1 hex) IM_TAG_FUNCTION Read/write (32 bytes) IM_TAG_LOCATION Read/write (22 bytes) Maintenance data 2: (data record index AFF2 hex) IM_DATE Read/write (16 bytes) Maintenance data 3: (data record index AFF3 hex) IM_DESCRIPTOR Read/write (54 bytes) - Enter a module identifier here that is unique plant-wide. - Enter the installation location of the module here. YYYY-MM-DD HH:MM Enter the installation date of the module here. - Enter a comment describing the module. 96 Operating Instructions, 12/2017, A5E AB

98 Commissioning 8.8 Shared commissioning of projects 8.8 Shared commissioning of projects Team Engineering Within the framework of Team Engineering, several users work in parallel on a project and access the CPU from different engineering systems. The users can work on individual parts of a master project independently of one another at the same time. The CPU show the changes of the other editors in a synchronization dialog during the loading of the configuration into the CPU and synchronizes the changes automatically, if possible. Certain online functions can also be executed in parallel from several engineering systems on a shared CPU, such as: Monitoring blocks on the CPU Modifying blocks on the CPU Trace functions You can find detailed information on Team Engineering in the STEP 7 online help. Operating Instructions, 12/2017, A5E AB 97

99 SIMATIC memory card SIMATIC memory card - overview Introduction The CPU uses a SIMATIC memory card as a memory module. The SIMATIC memory card is a preformatted memory card compatible with the Windows file system. The memory card is available in different memory sizes and can be used for the following purposes: Transportable data carrier Program card Firmware update card Service data card If you transfer the user program to the CPU via an online connection, it is written to the SIMATIC memory card, which must be in the card slot of the CPU for this to work. You can also write the SIMATIC memory card in the PG/PC. A commercially available SD card reader is required to write / read the SIMATIC memory card with the programming device / PC. This is used to copy files directly to the SIMATIC memory card using the Windows Explorer, for example. A SIMATIC memory card is absolutely required in order to operate the CPU. 98 Operating Instructions, 12/2017, A5E AB

100 SIMATIC memory card 9.1 SIMATIC memory card - overview Labeling of the SIMATIC memory card Article number Serial number Production version Memory size Slider for enabling write protection: Slider up: not write-protected Slider down: write-protected Figure 9-1 Labeling of the SIMATIC memory card Folders and files on the SIMATIC memory card The following folders and files can be found on the SIMATIC memory card: Table 9-1 Folder structure Folder FWUPDATE.S7S SIMATIC.S7S SIMATIC.HMI DataLogs Recipes Description Firmware update files for CPU and modules User program, i.e. all blocks (OBs, FCs, FBs, DBs) and system blocks, project data of the CPU HMI-relevant data DataLog files Recipe files Operating Instructions, 12/2017, A5E AB 99

101 SIMATIC memory card 9.1 SIMATIC memory card - overview Table 9-2 File structure File type S7_JOB.S7S SIMATIC.HMI\Backup\*.psb SIMATICHMI_Backups_DMS. bin LOG crdinfo.bin DUMP.S7S *.pdf, *.txt, *.csv,... Description Job file Panel backup files Protected file (required to use panel backup files in STEP 7) Protected system file (required in order to use the card) Protected system file (required in order to use the card) Service data file Further files with different formats that you can also store in folders of the SIMATIC memory card Use the serial number for copy protection You can set up copy protection for CPUs which binds execution of the block to a specific SIMATIC memory card. Configuration is carried out in STEP 7 in the properties of the block "Bind to serial number of the SIMATIC memory card". You can only execute the block if it is on the SIMATIC memory card with the specified serial number (see section Copy protection (Page 70)). Removing the SIMATIC memory card Only remove the SIMATIC memory card in POWER OFF mode of the CPU. Ensure that no writing functions (online functions with the programming device, e.g. loading/deleting a block, test functions) were active before POWER OFF. If you remove the SIMATIC memory card during a write process, the following problems can occur: The data content of a file is incomplete. The file is no longer readable, or no longer exists. The entire content of the card is corrupted. Inserting the SIMATIC memory card in the CPU in STOP mode triggers a re-evaluation of the SIMATIC memory card. The CPU hereby compares the content of the configuration on the SIMATIC memory card with the backed-up retentive data. If the backed-up retentive data matches the data of the configuration on the SIMATIC memory card, the retentive data is retained. If the data differs, the CPU automatically performs a memory reset (which means the retentive data is deleted) and then goes to STOP. Removing the SIMATIC memory card from Windows computers If you are using the card in a commercially available card reader under Windows, use the "Eject" function before you remove the card from the card reader. If you remove the card without using the "Eject" function, you may lose data. 100 Operating Instructions, 12/2017, A5E AB

102 SIMATIC memory card 9.1 SIMATIC memory card - overview Deleting the contents of the SIMATIC memory card You have the following options for deleting the contents of the SIMATIC memory card: Delete files using Windows Explorer Format with STEP 7 Note If you format the card with Windows utilities, you will render the SIMATIC memory card unusable as a storage medium for a CPU. Deletion of files and folders is permitted, with the exception of the " LOG " and "crdinfo.bin" system files. The CPU needs these system files. If you delete the files, you will no longer be able to use the SIMATIC memory card with the CPU. If you have deleted the " LOG " and "crdinfo.bin" system files, format the SIMATIC memory card as described in the following section. Formatting the SIMATIC memory card Note You may only format a SIMATIC memory card in the CPU; otherwise, the SIMATIC memory card cannot be used in the CPU. If you want to format the SIMATIC memory card using STEP 7, an online connection to the relevant CPU must exist. The relevant CPU is in the STOP mode. Proceed as follows to format a SIMATIC memory card: 1. Open the Online and Diagnostics view of the CPU (either from the project context or via "Accessible devices"). 2. In the "Functions" folder, select the "Format memory card" group. 3. Click the "Format" button. 4. Click "Yes" in response to the confirmation prompt. Result: The SIMATIC memory card is formatted for use in the CPU. The data on the CPU is deleted with the exception of the IP address. Service life of a SIMATIC memory card The service life of a SIMATIC memory card depends essentially on the following factors: Number of delete/write operations per memory block Number of written bytes External influences, such as ambient temperature Operating Instructions, 12/2017, A5E AB 101

103 SIMATIC memory card 9.1 SIMATIC memory card - overview Reference You can find additional information on the service life of the SIMATIC memory card as well as on memory utilization and memory areas to be used in the Structure and Use of the CPU Memory ( Function Manual. Instruction GetSMCinfo In the TIA Portal, you have the possibility to read out the inserted SIMATIC memory card via the instruction GetSMCinfo. The following information can be read via the instruction: Memory size in KB Assigned memory space in KB Maintenance information: Portion of the service life in % used to date Set proportion of the service life as a percentage after which the CPU creates a diagnostics buffer entry and the maintenance LED switches on. You can find additional information on the GetSMCinfo instruction in the STEP 7 online help. 102 Operating Instructions, 12/2017, A5E AB

104 SIMATIC memory card 9.2 Setting the card type 9.2 Setting the card type Introduction You can use the SIMATIC memory card as a program card or as a firmware update card. Procedure 1. To set the card type, insert the SIMATIC memory card into the card reader of the programming device. 2. Select the "SIMATIC Card Reader" folder in the project tree. 3. In the properties of the selected SIMATIC memory card, specify the card type: Program card You use a program card as an external load memory for the CPU. It contains the entire user program for the CPU. The CPU transfers the user program from the load memory to the work memory. The user program runs in the work memory. If you remove the SIMATIC memory card with the user program, the CPU goes into STOP mode. The following folder is created on the SIMATIC memory card: SIMATIC.S7 Firmware update card You can save firmware for the CPU and for the modules on one SIMATIC memory card. You can perform a firmware update with the help of a specially prepared SIMATIC memory card. The following folder is created on the SIMATIC memory card: FWUPDATE.S7S Reference You can find additional information in the STEP 7 online help. Operating Instructions, 12/2017, A5E AB 103

105 SIMATIC memory card 9.3 Data transfer with SIMATIC memory cards 9.3 Data transfer with SIMATIC memory cards Transferring objects from the project to a SIMATIC memory card When the SIMATIC memory card is inserted in the programming device or external card reader, you can transfer the following objects from the project tree (STEP 7) to the SIMATIC memory card: Individual blocks (multiple selection possible) In this case, the transfer is consistent, i.e. the function takes dependencies between blocks due to block calls into account. CPU folder In this case, all runtime-relevant objects including blocks and the hardware configuration are transferred onto the SIMATIC memory card - just as when downloading. Service data In this case, the service data saved beforehand (see section Reading out/saving service data (Page 119)) is transferred to the memory card. To perform a transfer, you can transfer the objects by drag-and-drop or use the "Card Reader/USB memory > Write to memory card" command in the "Project" menu. Firmware update via SIMATIC memory card You can find information on how to perform a firmware update via SIMATIC memory card in the section Firmware update (Page 105). Reference You can find additional information on thesimatic memory card in the STEP 7 online help. 104 Operating Instructions, 12/2017, A5E AB

106 Maintenance Firmware update Introduction During operation, it may be necessary to update the firmware (e.g. due to function extensions). You update the firmware of the CPU/modules with the help of firmware files. The retentive data of the CPU is retained after performing the firmware update. Requirement You have downloaded the file(s) for the firmware update from the Product Support ( web page. Select the ET 200pro category from the product tree for this: Automation Technology > Automation Systems > Industrial Automation Systems SIMATIC > SIMATIC ET 200 I/O systems > ET 200 systems without cabinet > ET 200pro. Figure 10-1 ET 200pro in the product tree Operating Instructions, 12/2017, A5E AB 105

107 Maintenance 10.1 Firmware update Select the specific module type under ET 200pro that you want to update. To continue, click on the "Software downloads" link under "Support". Save the desired firmware update files. Figure 10-2 Selecting the software downloads Before installing the firmware update, ensure that the modules are not being used. Options for the firmware update There are the following options for performing a firmware update: Online in STEP 7 via Online & Diagnostics Via the SIMATIC memory card Via the integrated Web server Online in STEP 7 via accessible devices Online via the SIMATIC Automation Tool 106 Operating Instructions, 12/2017, A5E AB

108 Maintenance 10.1 Firmware update The table below provides an overview of the media that can be used to update the firmware of a specific module. Table 10-1 Overview of firmware update options Firmware update CPU Electronic modules, central * Electronic modules, distributed * STEP 7 Accessible devices SIMATIC memory card Web server of the CPU SIMATIC Automation Tool * Only the RFID-RF170C electronic modules support firmware update via STEP 7. Installation of the firmware update WARNING Impermissible plant states possible Installation of the firmware update causes the CPU to switch to STOP mode. STOP may affect the operation of an online process or a machine. Unexpected operation of a process or a machine can lead to fatal or severe injuries and/or to material damages. Ensure before installing the firmware update, that the CPU is not executing any active process. Procedure: online in STEP 7 via Online & diagnostics To perform a firmware update online via STEP 7, follow these steps: 1. Select the module in the device view. 2. Select the "Online & diagnostics" menu command from the shortcut menu. 3. Select the "Firmware update" group in the "Functions" folder. 4. To select the path to the firmware update files, click the "Browse" button in the "Firmware update" area. 5. Select the matching firmware file. The table in the "Firmware loader" area lists all modules for which an update is possible with the selected firmware file. 6. Click the "Run update" button. If the module can interpret the selected file, the file is downloaded to the module. If you must change the CPU mode, STEP 7 prompts you to do so with dialogs. Operating Instructions, 12/2017, A5E AB 107

109 Maintenance 10.1 Firmware update Updating the firmware The "Run firmware after update" check box is always selected. After a successful loading operation, the module receives the firmware and then operates with this new firmware. Note If a firmware update is interrupted, you must switch off the supply voltage of the CPU and then switch it on again before repeating the firmware update. Procedure: online in STEP 7 via accessible devices To perform a firmware update online via accessible devices, follow these steps: 1. From the "Online menu, select the "Accessible devices" menu item. 2. In the Accessible devices dialog, search for the accessible devices for the selected PROFINET interface. 3. To go to a device in the project tree, select the desired device from the list of accessible devices and click the "Show" button. 4. In the project tree, select the "Online & diagnostics" option of the desired device and perform the firmware update under the category Functions/Firmware update. Procedure via the SIMATIC memory card Proceed as follows perform a firmware update via the SIMATIC memory card: 1. Insert a SIMATIC memory card into the SD card reader of your programming device/computer. 2. To store the update file on the SIMATIC memory card, select the SIMATIC memory card in the "Card Reader/USB memory" folder in the project tree. 3. Select the "Card Reader/USB memory > Create firmware update memory card" command in the "Project" menu. 4. Use a file selection dialog to navigate to the firmware update file. In a further step you can decide whether you are deleting the content of the SIMATIC memory card or adding the firmware update files to the SIMATIC memory card. 5. Switch off the supply voltages 1L+ and 2L+ of the CPU, and loosen and remove the connection module from the CPU. 6. Insert the SIMATIC memory card with the firmware update files into the CPU. 7. Insert the connection module onto the CPU again and screw it into place. 8. Switch on the supply voltages 1L+ and 2L+ of the CPU. The firmware update begins shortly after the supply voltage is switched on. After completion of the firmware update, the RUN LED lights up yellow and the MAINT LED flashes yellow. 108 Operating Instructions, 12/2017, A5E AB

110 Maintenance 10.1 Firmware update 9. Switch off the supply voltages 1L+ and 2L+ of the CPU, and loosen and remove the connection module from the CPU. 10.Remove the SIMATIC memory card. If you use the SIMATIC memory card subsequently as a program card, delete the firmware update files (including JobFile "S7_JOB.S7S") manually. Procedure: via the integrated Web server The procedure is described in the Web server ( Function Manual. Procedure online via the SIMATIC Automation Tool The procedure is described in the SIMATIC Automation Tool ( manual (included in the SIMATIC Automation Tool). Reference You can find additional information on the procedure in the STEP 7 online help. Operating Instructions, 12/2017, A5E AB 109

111 Maintenance 10.2 Resetting the CPU to factory settings 10.2 Resetting the CPU to factory settings Function "Reset to factory settings" restores the CPU to its delivery state. The function deletes all information that was stored internally on the CPU. Recommendation: If you want to remove a CPU and use it elsewhere with a different program, or put it into storage, restore the CPU to its delivery state. When restoring the factory settings, remember that you also delete the IP address parameters. Options for resetting a CPU to factory settings You can reset the CPU to its as-delivered condition by: Using the mode selector Using STEP 7 Using the SIMATIC Automation Tool Required tool (only for procedure using the mode switch) Cross-tip screwdriver, size 2 Procedure using the mode selector Make sure that the CPU is in STOP mode (RUN/STOP LED lit yellow). Note Reset to factory settings Memory reset The procedure described below also corresponds to the procedure for a memory reset: Selector operation with inserted SIMATIC memory card: CPU executes a memory reset Selector operation without inserted SIMATIC memory card: CPU executes reset to factory settings Perform a reset to factory settings as follows: 1. Switch off the supply voltages 1L+ and 2L+ of the CPU. 2. Using the cross-tip screwdriver, loosen the 4 screws on the front of the connection module CM CPU 2PN M12, 7/8". 3. Remove the connection module from the CPU. 4. Remove the SIMATIC memory card from the card slot (see section Inserting/replacing SIMATIC memory card (Page 79)). 5. Insert the connection module onto the CPU again and screw it into place. 6. Switch on the supply voltages 1L+ and 2L+ of the CPU again. 110 Operating Instructions, 12/2017, A5E AB

112 Maintenance 10.2 Resetting the CPU to factory settings 7. Unscrew the screw cap from the CPU. 8. Set the mode selector to the STOP position. Result: The RUN/STOP LED lights up yellow. 9. Set the mode selector to the MRES position. Hold the mode switch in this position until the RUN/STOP LED lights up for the 2nd time and remains continuously lit (this takes three seconds). After this, release the switch. 10.Within the next three seconds, switch the mode selector back to the MRES position, and then back to STOP again. Result: The CPU executes a "Reset to factory settings", during which time the RUN/STOP LED flashes yellow. When the RUN/STOP LED lights up yellow, then the CPU has been reset to factory settings, and is in the STOP mode. The "Reset to factory settings" event is entered into the diagnostics buffer. Note The IP address of the CPU is also deleted when the CPU is reset to the factory settings through the mode selector. Procedure using STEP 7 To reset a CPU to factory settings using STEP 7, follow these steps: Make sure that there is an online connection to the CPU. 1. Open the Online and Diagnostics view of the CPU. 2. In the "Functions" folder, select the "Reset to factory settings" group. 3. If you want to keep the IP address, select the "Keep IP address" option button. If you want to delete the IP address, select the "Delete IP address" option button. 4. Click the "Reset" button. 5. Click "OK" in response to the confirmation prompts. Result: The CPU executes a "Reset to factory settings", during which time the RUN/STOP LED flashes yellow. When the RUN/STOP LED lights up yellow, then the CPU has been reset to factory settings, and is in the STOP mode. The "Reset to factory settings" event is entered into the diagnostics buffer. Procedure using the SIMATIC Automation Tool The procedure is described in the SIMATIC Automation Tool ( manual (included in the SIMATIC Automation Tool). Operating Instructions, 12/2017, A5E AB 111

113 Maintenance 10.2 Resetting the CPU to factory settings Result after resetting to factory settings The following table provides an overview of the contents of the memory objects after the reset to factory settings. Table 10-2 Result after resetting to factory settings Memory object Actual values of the data blocks, instance data blocks Bit memories, timers and counters Retentive tags of technology objects (e.g. adjustment values of absolute encoders) Diagnostics buffer entries IP address Contents Initialized Initialized Initialized Initialized Depends on the procedure: Using mode switch: is deleted Using STEP 7: Depending on the setting of the "Keep IP address"/"delete IP address" option buttons Device name Counter readings of the runtime meters Time of day Initialized Initialized Initialized If a SIMATIC memory card was inserted prior to the reset to factory settings, the CPU downloads the configuration contained on the SIMATIC memory card (hardware and software). A configured IP address is then valid again. Reference Additional information on "Reset to factory settings" can be found in the Structure and Use of the CPU Memory ( Function Manual in the section on memory areas and retentivity, and in the STEP 7 online help. For information on the memory reset of the CPU, refer to the section CPU memory reset (Page 87). 112 Operating Instructions, 12/2017, A5E AB

114 Test functions and fault resolution Test functions Introduction You have the option of testing the operation of your user program on the CPU. You can then monitor signal states and values of tags and can assign values to tags to simulate specific situations in the running of the program. Note Using test functions The use of test functions can influence the program execution time and thus the cycle and response times of the controller to a slight extent (a few milliseconds). Requirements There is an online connection to the relevant CPU. An executable user program is available in the CPU. Test options Testing with program status Testing with breakpoints Testing with a watch table Testing with a force table Testing with a PLC tag table Testing with a data block editor Testing with the LED flash test Testing with a trace function Operating Instructions, 12/2017, A5E AB 113

115 Test functions and fault resolution 11.1 Test functions Testing with program status The program status allows you to monitor the execution of the program. You can display the values of operands and the results of logic operations (RLO) allowing you to recognize and fix logical errors in your program. Note Restrictions with the "Program status" function The monitoring of loops can increase the cycle time significantly, depending in each case on the number of tags to be monitored and on the actual number of loops processed. WARNING Testing with program status A test with the "Program status" function can cause serious damage to property or injury to persons if there are functional disturbances or program errors. Make sure that no dangerous situations can arise before you conduct a test with the "Program status" function. Testing with breakpoints With this test option, you set breakpoints in the program code, establish an online connection and enable the breakpoints on the CPU. When testing with breakpoints, you run a program from breakpoint to breakpoint. Requirements: You can set breakpoints in the programming languages SCL or STL Testing with breakpoints offers the following advantages: Narrowing down logic errors step-by-step Simple and rapid analysis of complex programs before actual commissioning Acquisition of actual values within individual loop passes Utilization of breakpoints for program validation also possible in SCL networks with LAD / FBD possible Note Restrictions when testing with breakpoints If you test with breakpoints, it is possible that the cycle time of the CPU is exceeded. 114 Operating Instructions, 12/2017, A5E AB

116 Test functions and fault resolution 11.1 Test functions Note F-System SIMATIC Safety Setting breakpoints in the standard user program results in errors in the Safety program: Expiration of the fail-safe cycle time monitoring Error in communication with the fail-safe I/O devices Errors during safety-related CPU-CPU communication Internal CPU error If you nevertheless want to use breakpoints for testing, you must deactivate safety mode beforehand. This results in the following errors: Error in communication with the fail-safe I/O devices Errors during safety-related CPU-CPU communication Testing with watch tables The following functions are available in the watch table: Monitoring of tags You can use watch tables to monitor the current values of the individual tags of a user program or CPU on the programming device or PC and on the Web server. So that the Web server can display the value of the tag, you must specify a symbolic name for the tag in the "Name" column of the watch table. You can monitor the following operand areas: Inputs and outputs (process image) and bit memory Contents of data blocks Peripheral inputs and peripheral outputs Timers and counters Modifying tags Use this function to assign fixed values to the individual tags of a user program or CPU on the PG/PC. Modifying is also possible with Test with program status. The following operand areas are modifiable: Inputs and outputs (process image) and bit memory Contents of data blocks Peripheral inputs and peripheral outputs (for example, %I0.0:P, %Q0.0:P) Timers and counters "Enable peripheral outputs" and "Modify now" These two functions enable you to assign fixed values to individual peripheral outputs of a CPU in the STOP mode. You can also use them to check your wiring. Operating Instructions, 12/2017, A5E AB 115

117 Test functions and fault resolution 11.1 Test functions Testing with a force table The following functions are available in the force table: Monitoring of tags You can use force tables to have the current values of the individual tags of a user program or CPU displayed on the programming device or PC and on the Web server. You can monitor the table with or without trigger condition. You can monitor the following tags: Bit memory Contents of data blocks Peripheral inputs Modifying tags Use this function to assign fixed values to the individual tags of a user program or CPU on the PG/PC. Modifying is also possible with Test with program status. The following tags are modifiable: Bit memory Contents of data blocks Peripheral inputs (e.g. %I0.0:P) Forcing of peripheral inputs and peripheral outputs You can force individual peripheral inputs or peripheral outputs. Peripheral inputs: Forcing of peripheral inputs (for example %I0.0:P) is a "bypassing" of sensors / inputs by the specification of fixed values to the program. The program receives the force value instead of the actual input value (via process image or via direct access). Peripheral outputs: Forcing of peripheral outputs (for example %Q0.0:P) is a "bypassing" of the complete program by the specification of fixed values to the actuators. One advantage of the force table is that you can simulate different test environments and overwrite tags in the CPU with a permanent value. This enables you to intervene in the ongoing process for regulating purposes. Difference between modifying and forcing The fundamental difference between the modifying and forcing functions consists in the storage behavior: Modifying: Modifying of tags is an online function and is not stored in the CPU. You can end modifying of tags in the watch table or force table or by terminating the online connection. Forcing: A force job is written to the SIMATIC memory card and is retained after a POWER OFF. You can only end the forcing of peripheral inputs and peripheral outputs in the force table. 116 Operating Instructions, 12/2017, A5E AB

118 Test functions and fault resolution 11.1 Test functions Testing with a PLC tag table You can monitor the current data values of tags in the CPU directly in the PLC tag table. To do so, open the PLC tag table and start the monitoring. You also have the option of copying PLC tags to a watch table or force table so that you can monitor, control or force them in the table. Testing with a data block editor The data block editor offers different options for monitoring and modifying tags. These functions directly access the actual values of the tags in the online program. Actual values are the current values of tags in the CPU work memory at any moment during program execution. The following functions for monitoring and modifying are available in the database editor. Monitor tags online Modify individual actual values Create a snapshot of the actual values Overwrite actual values with a snapshot Note Setting data values during commissioning During commissioning of a plant, data values have to be frequently adjusted in order to optimally adapt the program to the general operating conditions on site. The declaration table for data blocks offers some functions for this purpose. Testing with the LED flash test In many online dialogs, you can perform an LED flash test. This function is useful, for example, when you are not sure which device in the hardware configuration corresponds to the station currently selected in the software. When you click the "Flash LED" button, an LED flashes at the currently selected station. On the CPU, the following LEDs flash: RUN/STOP LED, ERROR LED and MAINT LED. The LEDs flash until you cancel the flash test. Testing with a trace function The trace function is used to record the CPU tags, depending on the settable trigger conditions. Tags are, for example, drive parameters or system and user tags of a CPU. The CPU saves the recordings. You can display and evaluate the recordings, if necessary, with STEP 7 or via the Web server. The trace function can be called from the CPU's folder in the project tree, under the name "Traces". In connection with trace functions, please also note the following FAQ on the Internet ( Operating Instructions, 12/2017, A5E AB 117

119 Test functions and fault resolution 11.1 Test functions Simulation With STEP 7 you can run and test the hardware and software of the project in a simulated environment. Start the simulation using the menu command "Online" > "Simulation" > "Start". Reference You can find additional information on the test functions in the STEP 7 online help. Additional information about testing with trace functions is available in the Function Manual Using the trace and logic analyzer function ( 118 Operating Instructions, 12/2017, A5E AB

120 Test functions and fault resolution 11.2 Reading out/saving service data 11.2 Reading out/saving service data Service data In addition to the contents of the diagnostics buffer, the service data contain numerous additional data points about the internal status of the CPU. If a problem occurs with the CPU that cannot be solved with other methods, send the service data to our Service & Support team. The service data allow Service & Support to analyze problems that have occurred rapidly. Note While reading out the service data of the CPU, you cannot simultaneously execute a download to the device. Methods of reading service data You can read out service data with: The Web server STEP 7 The SIMATIC memory card Procedure using the Web server To read service data using the Web server, follow these steps: 1. Open a web browser that is suitable for communication with the CPU. 2. Enter the following address in the address bar of the web browser: IP address>/save_service_data, e.g The service data page will appear on your screen, with a button for saving the service data. Figure 11-1 Reading out service data via the web server 4. Save the service data locally on your PC/programming device, by clicking "Save ServiceData". Operating Instructions, 12/2017, A5E AB 119

121 Test functions and fault resolution 11.2 Reading out/saving service data Result: The data is saved in a.dmp file with the following naming convention: <Article number> <Serial number> <Time stamp>.dmp". You can change the file name. Note If you have defined your user page as the home page of the Web server, direct access to the service data by inputting the IP address of the CPU is not possible. For more information on reading out service data via a user-defined page, refer to the Web server ( function manual. Procedure using STEP 7 A description of how to save service data is available under the keyword "Saving service data" in the STEP 7 online help. Procedure via the SIMATIC memory card Use the SIMATIC memory card to read out the service data only if you are no longer able to communicate with the CPU via Ethernet. In all other cases it is preferable to read out the service data via the Web server or STEP 7. Before reading out the service data, you must ensure that there is sufficient memory space on the SIMATIC memory card. To read service data using the SIMATIC memory card, follow these steps: 1. Insert the SIMATIC memory card into the card reader of your PC / programming device. 2. Open the job file S7_JOB.S7S in an editor. 3. Overwrite the entry PROGRAM with the string DUMP in the editor. To ensure that the file size is exactly 4 bytes, do not use any spaces/line breaks/quotation marks. 4. Save the file under the existing file name. 5. Ensure that the SIMATIC memory card is not write protected and insert it in the card slot of the CPU. Follow the procedure in section Inserting/replacing SIMATIC memory card (Page 79). Result: The CPU writes the service data file DUMP.S7S to the SIMATIC memory card and remains in STOP mode. The transfer of the service data has been completed as soon as the STOP LED stops flashing and lights up continuously. If the transfer was successful, only the STOP LED lights up. If the transfer was not successful, the STOP LED lights up and the ERROR LED flashes. In case of an error, the CPU stores a text file with a note on the error that occurred in the DUMP.S7S folder. 120 Operating Instructions, 12/2017, A5E AB

122 Interrupts, diagnostics, error messages and system 12 events The following section describes the status and fault displays of the CPU 1516pro-2 PN. You can find more detailed information on "Interrupts" in the STEP 7 online help. Note Diagnostic data of the Integrated power module The CPU 1516pro-2 PN is equipped with an integrated power module for the load voltage supply 2L+ of ET 200pro. You can find additional information on the topics of "Diagnostics" and "System alarms" in the Diagnostics ( function manual. Operating Instructions, 12/2017, A5E AB 121

123 Interrupts, diagnostics, error messages and system events 12.1 Status and error display of the CPU 12.1 Status and error display of the CPU LED display The figure below shows the LED displays of the CPU 1516pro-2 PN RUN/STOP LED (yellow/green LED) ERROR LED (red LED) MAINTENANCE LED (yellow LED) LINK RX/TX LED for port X1 P1 (yellow/green LED) LINK RX/TX LED for port X1 P2 (yellow/green LED) LINK RX/TX LED for port X2 P1 (yellow/green LED) DC 24V (green LED) LINK LEDs for port X1 P3 (green LED, directly on the RJ45 socket, not labeled) RX/TX LEDs for port X1 P3 (yellow LED, directly on the RJ45 socket, not labeled) Figure 12-1 LED display of the CPU 1516pro-2 PN 122 Operating Instructions, 12/2017, A5E AB

124 Interrupts, diagnostics, error messages and system events 12.1 Status and error display of the CPU Meaning of the RUN/STOP, ERROR and MAINTENANCE LEDs The CPU 1516pro-2 PN has three LEDs for displaying the current operating state and diagnostic status. The following table shows the meaning of the various combinations of colors of the RUN/STOP, ERROR and MAINTENANCE LEDs. Table 12-1 Meaning of the LEDs RUN/STOP LED ERROR LED MAINTENANCE LED Meaning Missing or insufficient power supply on the CPU. LED off LED off LED off An error has occurred. LED off LED flashes red LED off LED lit green LED off LED off LED lit green LED flashes red LED off LED lit green LED off LED lit yellow LED lit green LED off LED flashes yellow LED lit green LED flashes red LED off CPU is in RUN mode. A diagnostics event is pending. Maintenance demanded for the plant. The affected hardware must be checked/exchanged within a short period. Active Force job PROFIenergy pause Maintenance required for the plant. The affected hardware must be checked/exchanged within a short period. Bad configuration An error has occurred. LED lit yellow LED flashes red LED off Firmware update successfully completed. LED lit yellow LED off LED flashes yellow LED lit yellow LED off LED off LED lit yellow LED flashes red LED flashes yellow LED flashes yellow LED off LED off LED flashes yellow/green LED flashes yellow/green LED off LED flashes red LED off LED flashes yellow CPU is in STOP mode. The program on the SIMATIC memory card is causing an error. CPU defective CPU is performing internal activities during STOP, e.g. startup after STOP. Download of the user program from the SIMATIC memory card Startup (transition from RUN STOP) Startup (CPU booting) Test of LEDs during startup, inserting a module. LED flashing test Operating Instructions, 12/2017, A5E AB 123

125 Interrupts, diagnostics, error messages and system events 12.1 Status and error display of the CPU Meaning of LINK RX/TX LED X1 P1, X1 P2 and X2 P1 each have a LINK RX/TX LED (yellow/green LED). Port X1 P3 has a LINK LED (green) and an RX/TX LED (yellow). The table below shows the various "LED scenarios" of ports X1 P1, X1 P2 and X2 P1. LINK RX/TX LED * LED off LED flashes green LED lit green LED flickers yellow Meaning There is no Ethernet connection between the PROFINET interface of the PROFINET device and the communications partner. No data is currently being sent/received via the PROFINET interface. There is no LINK connection. The "LED flashing test" is being performed. There is an Ethernet connection between the PROFINET interface of your PROFINET device and a communication partner. Data is currently being received from or sent to a communications partner on Ethernet via the PROFINET interface of the PROFINET device. * At startup, the CPU does not perform an LED flash test, i.e. the LEDs do not light up immediately. The table below shows the various "LED scenarios" of port X1 P3. LINK RX/TX LED * Green LED and yellow LED off Green LED flashes green Green LED lit green Yellow LED flickers yellow Meaning There is no Ethernet connection between the PROFINET interface of the PROFINET device and the communications partner. No data is currently being sent/received via the PROFINET interface. There is no LINK connection. The "LED flashing test" is being performed. There is an Ethernet connection between the PROFINET interface of your PROFINET device and a communication partner. Data is currently being received from or sent to a communications partner on Ethernet via the PROFINET interface of the PROFINET device. * At startup, the CPU does not perform an LED flash test, i.e. the LEDs do not light up immediately. Status display 24 V DC The 24 V DC LED lights up green when you have connected the load voltage supply 2L+. If the LED does not light up, check whether the power supply is switched on and the fuse is okay. In the case of the 24 V DC LED, the CPU does not perform an "LED flash test", i.e. the LED does not light up immediately after switching on the load voltage supply 2L Operating Instructions, 12/2017, A5E AB

126 Interrupts, diagnostics, error messages and system events 12.1 Status and error display of the CPU Identification of the PROFINET device in the control cabinet During initial commissioning, you must assign a device name to PROFINET IO devices. You can have the LINK LED of a PROFINET IO device flash in STEP 7. This enables you, for example, to clearly identify a PROFINET IO device to be addressed from several identical devices in a control cabinet. MAINTENANCE LED This LED indicates that a maintenance demand exists, e.g. loss of synchronization of station, Operating Instructions, 12/2017, A5E AB 125

127 Technical specifications 13 General technical specifications The CPU 1516pro-2 PN also complies with the standards and test values applicable to the ET 200pro distributed I/O system. You can find detailed information on the general technical specifications in the ET 200pro Distributed I/O System ( operating instructions. Technical specifications of the CPU 1516pro-2 PN Article number General information Product type designation HW functional status 6ES7516-2PN00-0AB0 CPU 1516pro-2 PN FS02 Firmware version V2.5 Engineering with STEP 7 TIA Portal configurable/integrated as of version Configuration control via dataset No Control elements Mode selector switch 1 Supply voltage Type of supply voltage 24 V DC permissible range, lower limit (DC) 20.4 V permissible range, upper limit (DC) 28.8 V Reverse polarity protection Yes Mains buffering Mains/voltage failure stored energy time 5 ms V15 (FW V2.5) / V14 (FW V2.0) or higher Input current Current consumption (rated value) Inrush current, max. I²t Power Infeed power to the backplane bus Power loss Power loss, typ A 0.4 A; Rated value A² s W 5.3 W 126 Operating Instructions, 12/2017, A5E AB

128 Technical specifications Article number Memory Number of slots for SIMATIC memory card 1 SIMATIC memory card required Work memory 6ES7516-2PN00-0AB0 Yes integrated (for program) 1 Mbyte integrated (for data) 5 Mbyte Load memory Plug-in (SIMATIC Memory Card), max. 32 Gbyte Backup maintenance-free Yes CPU processing times for bit operations, typ. for word operations, typ. for fixed point arithmetic, typ. for floating point arithmetic, typ. CPU-blocks DB FB FC Number of elements (total) 10 ns 12 ns 16 ns 64 ns 6 000; Blocks (OB, FB, FC, DB) and UDTs Number range ; subdivided into: number range that can be used by the user: , and number range of DBs created via SFC 86: Size, max. 5 Mbyte; For non-optimized block accesses, the max. size of the DB is 64 KB Number range Size, max. 1 Mbyte Number range Size, max. 1 Mbyte Operating Instructions, 12/2017, A5E AB 127

129 Technical specifications Article number 6ES7516-2PN00-0AB0 OB Size, max. 1 Mbyte Number of free cycle OBs 100 Number of time alarm OBs 20 Number of delay alarm OBs 20 Number of cyclic interrupt OBs 20; With minimum OB 3x cycle of 500 µs Number of process alarm OBs 50 Number of DPV1 alarm OBs 3 Number of isochronous mode OBs 2 Number of technology synchronous alarm OBs 2 Number of startup OBs 100 Number of asynchronous error OBs 4 Number of synchronous error OBs 2 Number of diagnostic alarm OBs 1 Nesting depth per priority class 24 Counters, timers and their retentivity S7 counter Number Retentivity adjustable Yes IEC counter Number Any (only limited by the main memory) Retentivity adjustable Yes S7 times Number Retentivity adjustable Yes IEC timer Number Any (only limited by the main memory) Retentivity adjustable Yes 128 Operating Instructions, 12/2017, A5E AB

130 Technical specifications Article number Data areas and their retentivity Flag Retentive data area (incl. timers, counters, flags), max. Number, max. 16 kbyte 6ES7516-2PN00-0AB0 512 kbyte; In total; available retentive memory for bit memories, timers, counters, DBs, and technology data (axes): 472 KB Number of clock memories 8; 8 clock memory bits, grouped into one clock memory byte Data blocks Retentivity adjustable Yes Retentivity preset No Local data per priority class, max. 64 kbyte; max. 16 KB per block Address area Number of IO modules 8 192; max. number of modules / submodules I/O address area Inputs 32 kbyte; All inputs are in the process image Outputs 32 kbyte; All outputs are in the process image per integrated IO subsystem Inputs (volume) 8 kbyte Outputs (volume) 8 kbyte Subprocess images Number of subprocess images, max. 32 Address space per module Address space per module, max. 256 byte; For input and output data respectively Address space per station Address space per station, max byte; for central inputs and outputs; depending on configuration Hardware configuration Number of distributed IO systems 64; A distributed I/O system is characterized not only by the integration of distributed I/O via PROFINET or PROFIBUS communication modules, but also by the connection of I/O via AS-i master modules or links (e.g. IE/PB-Link) Number of IO Controllers integrated 2 Rack Via CM 0 Modules per rack, max. 16; Expansion width max. 1 m Number of lines, max. 1 Operating Instructions, 12/2017, A5E AB 129

131 Technical specifications Article number Time of day Clock 6ES7516-2PN00-0AB0 Type Hardware clock Backup time 6 wk; At 40 C ambient temperature, typically Deviation per day, max. 10 s; Typ.: 2 s Operating hours counter Number 16 Clock synchronization supported Yes in AS, master Yes in AS, slave Yes on Ethernet via NTP Yes Interfaces Number of PROFINET interfaces 2 Number of PROFIBUS interfaces 0 1. Interface Interface types Number of ports 3; 2x M12 + 1x RJ45 integrated switch Yes RJ 45 (Ethernet) Yes; X1 P3 Functionality IP protocol Yes; IPv4 PROFINET IO Controller Yes PROFINET IO Device Yes SIMATIC communication Yes Open IE communication Yes Web server Yes Media redundancy Yes; MRP Automanager according to IEC Edition Operating Instructions, 12/2017, A5E AB

132 Technical specifications Article number PROFINET IO Controller Services PG/OP communication Yes S7 routing Yes Isochronous mode Yes Open IE communication Yes IRT Yes 6ES7516-2PN00-0AB0 MRP Yes; As MRP redundancy manager and/or MRP client; max. number of devices in the ring: 50 MRPD Yes; Requirement: IRT PROFIenergy Yes Prioritized startup Yes; Max. 32 PROFINET devices Number of connectable IO Devices, max. Of which IO devices with IRT, max ; In total, up to distributed I/O devices can be connected via AS-i, PROFIBUS or PROFINET Number of connectable IO Devices for RT, max. 256 of which in line, max. 256 Number of IO Devices that can be simultaneously activated/deactivated, max. 8; in total across all interfaces Number of IO Devices per tool, max. 8 Updating times The minimum value of the update time also depends on communication share set for PROFINET IO, on the number of IO devices, and on the quantity of configured user data Update time for IRT for send cycle of 250 µs 250 μs to 4 ms; Note: In the case of IRT with isochronous mode, the minimum update time of 500 µs of the isochronous OB is decisive for send cycle of 500 µs 500 µs to 8 ms for send cycle of 1 ms 1 ms to 16 ms for send cycle of 2 ms 2 ms to 32 ms for send cycle of 4 ms 4 ms to 64 ms With IRT and parameterization of "odd" send cycles Update time = set "odd" send clock (any multiple of 125 µs: 375 µs, 625 µs µs) Operating Instructions, 12/2017, A5E AB 131

133 Technical specifications Article number 6ES7516-2PN00-0AB0 Update time for RT for send cycle of 250 µs 250 µs to 128 ms for send cycle of 500 µs 500 µs to 256 ms for send cycle of 1 ms 1 ms to 512 ms for send cycle of 2 ms 2 ms to 512 ms for send cycle of 4 ms 4 ms to 512 ms PROFINET IO Device Services PG/OP communication Yes S7 routing Yes Isochronous mode No Open IE communication Yes IRT Yes MRP Yes MRPD Yes; Requirement: IRT PROFIenergy Yes Prioritized startup No Shared device Yes Number of IO Controllers with shared device, max. 4 Asset management record Yes; Per user program 2. Interface Interface types Number of ports 1; 1x M12 integrated switch No RJ 45 (Ethernet) No Functionality IP protocol Yes; IPv4 PROFINET IO Controller Yes PROFINET IO Device Yes SIMATIC communication Yes Open IE communication Yes Web server Yes Media redundancy No 132 Operating Instructions, 12/2017, A5E AB

134 Technical specifications Article number 6ES7516-2PN00-0AB0 PROFINET IO Controller Services PG/OP communication Yes S7 routing Yes Isochronous mode No Open IE communication Yes IRT No MRP No PROFIenergy Yes Prioritized startup No Number of connectable IO Devices, max. Number of connectable IO Devices for RT, max. 32; In total, up to distributed I/O devices can be connected via AS-i, PROFIBUS or PROFINET 32 of which in line, max. 32 Number of IO Devices that can be simultaneously activated/deactivated, max. 8; in total across all interfaces Number of IO Devices per tool, max. 8 Updating times The minimum value of the update time also depends on communication share set for PROFINET IO, on the number of IO devices, and on the quantity of configured user data Update time for RT for send cycle of 1 ms 1 ms to 512 ms PROFINET IO Device Services PG/OP communication Yes S7 routing Yes Isochronous mode No Open IE communication Yes IRT No MRP No MRPD No PROFIenergy Yes Prioritized startup No Shared device Yes Number of IO Controllers with shared device, max. 4 Asset management record Yes; Per user program Operating Instructions, 12/2017, A5E AB 133

135 Technical specifications Article number 6ES7516-2PN00-0AB0 Interface types RJ 45 (Ethernet) 100 Mbps Yes Autonegotiation Yes Autocrossing Yes Industrial Ethernet status LED Yes Protocols Number of connections Number of connections, max. 128; Via integrated interfaces of the CPU Number of connections reserved for ES/HMI/web Number of connections via integrated interfaces Number of S7 routing paths 16 SIMATIC communication S7 communication, as server Yes S7 communication, as client Yes User data per job, max. See online help (S7 communication, user data size) Open IE communication TCP/IP Yes Data length, max. 64 kbyte several passive connections per port, supported Yes ISO-on-TCP (RFC1006) Yes Data length, max. 64 kbyte UDP Yes Data length, max. 2 kbyte; bytes for UDP broadcast UDP multicast Yes; Max. 5 multicast circuits DHCP No SNMP Yes DCP Yes LLDP Yes Web server HTTP Yes; Standard and user pages HTTPS Yes; Standard and user pages 134 Operating Instructions, 12/2017, A5E AB

136 Technical specifications Article number OPC UA Runtime license required Yes 6ES7516-2PN00-0AB0 OPC UA Server Yes; Data access (read, write, subscribe), method call, custom address space Application authentication Yes Security policies Available security policies: None, Basic128Rsa15, Basic256Rsa15, Basic256Sha256 User authentication "anonymous" or by user name & password Further protocols MODBUS Yes; MODBUS TCP Media redundancy Switchover time on line break, typ. 200 ms; For MRP, bumpless for MRPD Number of stations in the ring, max. 50 Isochronous mode Isochronous operation (application synchronized up to terminal) S7 message functions Number of login stations for message functions, max. Program alarms Yes; Via X1, with minimum OB 6x cycle of 500 µs 32 Yes Number of configurable program alarms Number of simultaneously active program alarms Number of program alarms 600 Number of alarms for system diagnostics 200 Number of alarms for motion technology objects 160 Test commissioning functions Joint commission (Team Engineering) Yes; Parallel online access possible for up to 8 engineering systems Status block Yes; Up to 8 simultaneously (in total across all ES clients) Single step No Number of breakpoints 8 Status/control Status/control variable Yes Variables Inputs/outputs, memory bits, DBs, distributed I/Os, timers, counters Number of variables, max. of which status variables, max. 200; per job of which control variables, max. 200; per job Operating Instructions, 12/2017, A5E AB 135

137 Technical specifications Article number 6ES7516-2PN00-0AB0 Forcing Forcing, variables Peripheral inputs/outputs Number of variables, max. 200 Diagnostic buffer present Yes Number of entries, max of which powerfail-proof 500 Traces Number of configurable Traces 4; Up to 512 KB of data per trace are possible Interrupts/diagnostics/status information Diagnostics indication LED RUN/STOP LED Yes ERROR LED Yes MAINT LED Yes Monitoring of the supply voltage (PWR- LED) Yes; Green "24 V DC" LED Connection display LINK TX/RX Yes Supported technology objects Motion Control Number of available Motion Control resources for technology objects (except cam disks) Required Motion Control resources per speed-controlled axis 40 per positioning axis 80 Yes; Note: The number of axes affects the cycle time of the PLC program; selection guide via the TIA Selection Tool or SIZER per synchronous axis 160 per external encoder 80 per output cam 20 per cam track 160 per probe 40 Positioning axis Number of positioning axes at motion control cycle of 4 ms (typical value) Number of positioning axes at motion control cycle of 8 ms (typical value) Operating Instructions, 12/2017, A5E AB

138 Technical specifications Article number Controller 6ES7516-2PN00-0AB0 PID_Compact Yes; Universal PID controller with integrated optimization PID_3Step Yes; PID controller with integrated optimization for valves PID-Temp Yes; PID controller with integrated optimization for temperature Counting and measuring High-speed counter Yes Standards, approvals, certificates Suitable for safety functions Ambient conditions Ambient temperature during operation No horizontal installation, min. -25 C horizontal installation, max. 55 C vertical installation, min. -25 C vertical installation, max. 55 C Ambient temperature during storage/transportation min. -40 C max. 70 C Configuration Programming Programming language LAD Yes FBD Yes STL Yes SCL Yes GRAPH Yes Know-how protection User program protection/password protection Yes Copy protection Yes Block protection Yes Access protection Protection level: Write protection Yes Protection level: Read/write protection Yes Protection level: Complete protection Yes Operating Instructions, 12/2017, A5E AB 137

139 Technical specifications Article number 6ES7516-2PN00-0AB0 Cycle time monitoring lower limit adjustable minimum cycle time upper limit adjustable maximum cycle time Dimensions Width Height Depth Weights Weight, approx. 135 mm 130 mm 65 mm 614 g Technical specifications of the connection module M12 7/8" Article number Accessories 6ES7194-4AP00-0AA0 Function description Terminal module M12 7/8": 2x PROFINET and 24 V power; 3x M12 and 2x 7/8" power supply from 1L+ and 2L+ max. 8 A each, internal transfer 2L+ max. 8 A, 1L+ max. 5 A belongs to product Dimensions Width Height Depth Weights Weight, approx. ET 200pro; CPU 1516pro (F)-2 PN 90 mm 130 mm 51 mm 560 g 138 Operating Instructions, 12/2017, A5E AB

140 Dimension diagram A CPU 1516pro-2 PN with connection module CM CPU 2PN M12, 7/8" This section contains dimension drawings of the module mounted on various module racks. You must observe the dimensions when mounting in cabinets, control rooms, etc. Figure A-1 Dimension diagram - Rack, narrow Figure A-2 Dimension diagram - Rack, compact Operating Instructions, 12/2017, A5E AB 139

141 Accessories/spare parts B Order number of CPU and connection module Designation CPU 1516pro-2 PN Connection module CM CPU 2PN M12 7/8 Article number 6ES7516-2PN00-0AB0 6ES7194-4AP00-0AA0 Order numbers of accessories Designation Preassembled cables and connectors: IE M12 connecting cable Trailable cable Preassembled with M12 connectors 180 at both ends, fixed lengths, 1 unit: IE M12 connecting cable Trailable cable Preassembled with angled M12 connectors 180 at both ends, fixed lengths, 1 unit: IE M12 connecting cable Trailable cable Preassembled with angled M12 connector 180 at one end (one end male, one end open), fixed lengths, 1 unit: IE M12 connecting cable Trailable cable Preassembled with M12 connector 180 (male) at one end, other end with RJ45 Plug 145, fixed lengths, 1 unit: Article number 0.3 m 6XV1870-8AE m 6XV1870-8AE m 6XV1870-8AH m 6XV1870-8AH m 6XV1870-8AH m 6XV1870-8AH m 6XV1870-8AH m 6XV1870-8AN m 6XV1870-8AN m 3RK1902-2NB m 3RK1902-2NB m 3RK1902-2NC m 3RK1902-2HB m 3RK1902-2HB m 3RK1902-2HC m 6XV1871-5TH m 6XV1871-5TH m 6XV1871-5TH m 6XV1871-5TN m 6XV1871-5TN Operating Instructions, 12/2017, A5E AB

142 Accessories/spare parts Designation 7/8" connecting cable for power supply Trailable power cable, 5 x 1.5 mm 2 Preassembled cable with 7/8" connectors 180 at both ends, fixed lengths, 1 unit: 7/8" connecting cable for power supply Trailable power cable, 5 x 1.5 mm 2 Preassembled cable with 7/8" angled connectors at both ends, fixed lengths, 1 unit 7/8" connecting cable for power supply Trailable power cable, 5 x 1.5 mm 2 Preassembled with 7/8" angled connector at one end (one end female, one end open), fixed lengths, 1 unit Article number 0.3 m 6XV1822-5BH m 6XV1822-5BH m 6XV1822-5BH m 6XV1822-5BH m 6XV1822-5BH m 6XV1822-5BH m 6XV1822-5BH m 6XV1822-5BN m 6XV1822-5BN m (on request) 2.0 m (on request) 3.0 m 3RK1902-3NB m 3RK1902-3NB m 3RK1902-3NC m (on request) 3.0 m 3RK1902-3GB m 3RK1902-3GB m 3RK1902-3GC10 Non-assembled cables and connectors: 7/8" plug connector (screw mechanism), male contact insert 5 units per package 7/8" plug connector (screw mechanism), female contact insert 5 units per package 7/8" connector (screw mechanism), angled, male contact insert 5 units per package 7/8" plug connector (screw mechanism), angled, female contact insert 5 units per package PROFINET M12 plug connector 1 unit per package d-coded with FastConnect connection system, units per package PROFINET M12 plug connector 1 unit per package d-coded with FastConnect connection system, units per package PROFINET M12 plug connector d-coded, angled 6GK1905-0FA00 6GK1905-0FB00 3RK1902-3BA00 3RK1902-3DA00 6GK1901-0DB10-6AA0 6GK1901-0DB10-6AA8 6GK1901-0DB20-6AA0 6GK1901-0DB20-6AA8 3RK1902-2DA00 Operating Instructions, 12/2017, A5E AB 141

143 Accessories/spare parts Designation Article number PROFINET FC cable FC TP Standard Cable 6XV1840-2AH10 FC TP Trailing Cable 6XV1840-3AH10 FC TP Trailing Cable GP 6XV1870-2D FC TP Marine Cable 6XV1840-4AH10 FC TP Torsion Cable 6XV1870-2F Energy Cable Trailable power cable, 5 x 1.5 mm 2 Sold by the meter, min. order quantity 20 m Delivery unit max m, 1 m M12 cover caps 10 units per package, 10 units 7/8" cover caps 10 units per package, 1 unit 6XV1830-8AH10 3RX AA00 6ES7194-3JA00-0AA0 SIMATIC memory cards Article number 6ES7954-8LCxx-0AA0 6ES7954-8LExx-0AA0 6ES7954-8LFxx-0AA0 6ES7954-8LL02-0AA0 6ES7954-8LPxx-0AA0 6ES7954-8LTxx-0AA0 Capacity 4 MB 12 MB 24 MB 256 MB 2 GB 32 GB 142 Operating Instructions, 12/2017, A5E AB

144 Safety-relevant symbols C C.1 Safety-related symbols for devices without Ex protection The following table contains an explanation of the symbols located in your SIMATIC device, its packaging or the accompanying documentation. Symbol Meaning General warning sign Caution/Notice You must read the product documentation. The product documentation contains information about the potential risks and enable you to recognize risks and implement countermeasures. Read the information provided by the product documentation. ISO 7010 M002 Ensure the device is only installed by electrically skilled person. IEC No Note that connected mains lines must be designed according to the expected minimum and maximum ambient temperature. Note that the device must be constructed and connected in accordance with EMC regulations. Note that a 230 V device can be exposed to electrical voltages which can be dangerous. ANSI Z535.2 Note that a device of Protection Class III may only be supplied with a protective low voltage according to the standard SELV/PELV. IEC "Class III equipment" Be aware that the device is only approved for the industrial field and only for indoor use. Note that an enclosure is required for installing the device. Enclosures are considered: Standing control cabinet Serial control cabinet Terminal boxes Wall enclosure Operating Instructions, 12/2017, A5E AB 143

145 Safety-relevant symbols C.2 Safety-related symbols for devices with Ex protection C.2 Safety-related symbols for devices with Ex protection The following table contains an explanation of the symbols located in your SIMATIC device, its packaging or the accompanying documentation. Symbol Meaning The assigned safety symbols apply to devices with Ex approval. You must read the product documentation. The product documentation contains information about the potential risks and enable you to recognize risks and implement countermeasures. Read the information provided by the product documentation. ISO 7010 M002 Ensure the device is only installed by electrically skilled person. IEC No Observe the mechanical rating of the device. Note that connected mains lines must be designed according to the expected minimum and maximum ambient temperature. Note that the device must be constructed and connected in accordance with EMC regulations. When the device is under voltage, note that it may not be installed or removed, or plugged or pulled. Note that a 230 V device can be exposed to electrical voltages which can be dangerous. ANSI Z535.2 Note that a device of Protection Class III may only be supplied with a protective low voltage according to the standard SELV/PELV. IEC "Class III equipment" Be aware that the device is only approved for the industrial field and only for indoor use. 144 Operating Instructions, 12/2017, A5E AB

146 Safety-relevant symbols C.2 Safety-related symbols for devices with Ex protection Symbol Meaning For Zone 2 potentially explosive atmospheres, be aware that the device may only be used when it is installed in an enclosure with a degree of protection IP54. For Zone 22 potentially explosive atmospheres, be aware that the device may only be used when it is installed in an enclosure with a degree of protection IP6x. Operating Instructions, 12/2017, A5E AB 145